Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-13505Zeroisation of sensitive key material on garbage collection relies on finalizationMaven · org.bouncycastle:bc-fips · fixed in 1.0.2.7, 2.0.2, 2.1.3
- CVE-2026-8798Native entropy source retries the CPU entropy instructions without limitMaven · org.bouncycastle:bc-fips · fixed in 2.1.3
- CVE-2026-52880Klever-Go: REST API slow-header connection exhaustion via Gin Engine.RunGo · github.com/klever-io/klever-go · fixed in 1.7.18
- CVE-2026-52879Klever-Go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoSGo · github.com/klever-io/klever-go · fixed in 1.7.18
- CVE-2026-52878Klever-Go: Unauthenticated nil-pointer DoS in P2P transaction validation can halt the chainGo · github.com/klever-io/klever-go · fixed in 1.7.18
- CVE-2026-49343Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoSGo · github.com/klever-io/klever-go · fixed in 1.7.18
- CVE-2026-48047XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) adminMaven · org.xwiki.platform:xwiki-platform-webjars-api · fixed in 16.10.17, 17.4.9, 17.10.3
- CVE-2026-47249Klever-Go KVM: Hash-array amplification in P2P resolver request handlingGo · github.com/klever-io/klever-go · fixed in 1.7.18
- CVE-2026-47243Kata guest escape: runtime-rs guest-root to host-root escape via virtiofsGo · github.com/kata-containers/kata-containers · fixed in 0.0.0-20260519062212-ffa59ce3aa78
- CVE-2026-48170scimPatch vulnerable to prototype pollution via unfiltered keys in patchnpm · scim-patch · fixed in 0.9.1
- CVE-2026-48169PraisonAI has Cross-Workspace IDOR and Privilege Escalation via Platform APIPyPI · praisonai-platform · fixed in 0.1.4
- CVE-2026-45808OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACLGo · github.com/openbao/openbao · fixed in 2.5.4
- CVE-2026-46405OpenBao's Kerberos Auth Method Accumulates Unaccessible TokensGo · github.com/openbao/openbao · fixed in 2.5.4
- CVE-2026-54338JupyterHub: Unauthenticated Denial of Service via Unbounded Username Logging on Failed LoginPyPI · jupyterhub · fixed in 5.5.0
- CVE-2026-69207Hono: ReDoS in CORS middleware via Access-Control-Request-Headersnpm · hono · fixed in 4.12.34
- CVE-2026-46358OpenBao's Inline Auth Incorrectly Redacted HeadersGo · github.com/openbao/openbao · fixed in 2.5.4
- CVE-2026-48007Element Call reports full URLs of visited pages to analytics servernpm · @element-hq/element-call-embedded · fixed in 0.19.4
- CVE-2026-48039Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access TokenPyPI · meta-ads-mcp · fixed in 1.0.109
- CVE-2026-71870pypdf: Possible large memory usage for large /ToUnicode streamsPyPI · pypdf · fixed in 6.15.0
- CVE-2026-71852pypdf: Possible long runtimes/large memory usage for large CID font width rangesPyPI · pypdf · fixed in 6.15.0
- CVE-2026-71851crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chainnpm · crypto-js · fixed in 4.0.0
- CVE-2026-71850Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosurenpm · hono · fixed in 4.12.34
- CVE-2026-71849Hono: Proxy Helper does not remove response headers listed in the `Connection` headernpm · hono · fixed in 4.12.34
- CVE-2026-71848Hono: Algorithmic Complexity DoS in Language Middlewarenpm · hono · fixed in 4.12.34
- CVE-2026-69127Kirby: System path exposure from error messages in the REST APIPackagist · getkirby/cms · fixed in 4.9.5, 5.5.2
- CVE-2026-71847Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streamsRubyGems · json · fixed in 2.21.2
- CVE-2026-56818Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate stateMaven · io.netty:netty-codec-redis · fixed in 4.1.136.Final, 4.2.16.Final
- CVE-2026-66062SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept headernpm · @sveltejs/kit · fixed in 2.70.2
- CVE-2026-71557go-git: Malicious reference names may modify files outside the reference storageGo · github.com/go-git/go-git/v5, github.com/go-git/go-git/v6 · fixed in 5.19.2, 6.0.0-alpha.5
- CVE-2026-71556go-git: Worktree operations may follow symlinksGo · github.com/go-git/go-git/v5, github.com/go-git/go-git/v6 · fixed in 5.19.2, 6.0.0-alpha.5