Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-62996Smarty Security stream restriction bypass through stream: resourcePackagist · smarty/smarty · fixed in 5.8.4
- CVE-2026-62992Smarty: Symlink path traversal out of trusted directoriesPackagist · smarty/smarty · fixed in 5.8.2, 4.5.7
- CVE-2026-12261Improper Access Control in nltk/nltkPyPI · nltk · fixed in 3.10.0
- CVE-2026-71554h2: Duplicate Host header could facilitate request smugglingPyPI · h2 · fixed in 4.4.1
- CVE-2026-48054OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.urinpm · @openzeppelin/wizard · fixed in 0.10.9
- CVE-2026-67434PHP_CodeSniffer gitblame report command injection via crafted filenamePackagist · squizlabs/php_codesniffer · fixed in 3.13.6, 4.0.2
- CVE-2026-71498node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScriptnpm · re2 · fixed in 1.26.1
- CVE-2026-71430node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string lengthnpm · re2 · fixed in 1.25.1
- CVE-2026-71497jsoup: Cleaner may expose markup with custom raw-text elementsMaven · org.jsoup:jsoup · fixed in 1.23.1
- CVE-2026-61632PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_pathPyPI · pymdown-extensions · fixed in 11.0.0
- CVE-2026-71488league/commonmark: Quadratic-time denial of service when parsing crafted MarkdownPackagist · league/commonmark · fixed in 2.9.0
- CVE-2026-71478league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytesPackagist · league/commonmark · fixed in 2.9.0
- CVE-2026-54717Silverstripe: XSS in breadcrumbs in page list viewPackagist · silverstripe/cms · fixed in 6.2.1
- CVE-2026-67422pymdown-extensions: Exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processorsPyPI · pymdown-extensions · fixed in 11.0.1
- CVE-2026-45378Decidim: Verification documents can be downloaded through reusable linksRubyGems · decidim-verifications · fixed in 0.30.9, 0.31.5, 0.32.0
- CVE-2026-45573Decidim: Push subscriptions can be abused for server-side requestsRubyGems · decidim-core · fixed in 0.30.9, 0.31.5, 0.32.0
- CVE-2026-45572Decidim: HTML content blocks allow stored script executionRubyGems · decidim-core · fixed in 0.30.9, 0.31.5, 0.32.0
- CVE-2026-71476Nx: Zip-Slip in the self-hosted remote cachenpm · @nx/azure-cache, @nx/gcs-cache +7 · fixed in 22.7.7, 23.0.2
- CVE-2026-71439Mermaid radar diagrams are vulnerable to DoSnpm · mermaid · fixed in 11.16.1
- CVE-2026-71438Mermaid configuration APIs allow prototype pollutionnpm · mermaid · fixed in 11.16.1, 10.9.8
- CVE-2026-50159Mermaid allows CSS injection applying to sibling elements of the diagramnpm · mermaid · fixed in 11.16.1, 10.9.8
- CVE-2026-71437Mermaid Architecture diagrams are vulnerable to prototype pollutionnpm · mermaid · fixed in 11.16.1
- CVE-2026-71436Mermaid XY Charts are vulnerable to an infinite loop DoSnpm · mermaid · fixed in 10.9.8, 11.16.1
- CVE-2026-71435Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email TemplatePackagist · statamic/cms · fixed in 5.74.3, 6.24.2
- CVE-2026-71434Statamic: Missing file upload validation on frontend forms allows uploading disallowed file typesPackagist · statamic/cms · fixed in 5.74.3, 6.24.2
- CVE-2026-45415Decidim: CSV census record endpoints improper authorizationRubyGems · decidim-verifications · fixed in 0.30.9, 0.31.5, 0.32.0
- CVE-2026-64662Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entriesPackagist · statamic/cms · fixed in 5.74.1, 6.24.0
- CVE-2026-64663Statamic: Unsafe method invocation via Antlers template resolution allows data destructionPackagist · statamic/cms · fixed in 5.74.1, 6.24.0
- CVE-2026-64665Statamic: Account takeover via OAuth email matching without email-verification checkPackagist · statamic/cms · fixed in 5.74.1, 6.24.0
- CVE-2026-64664Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existencePackagist · statamic/cms · fixed in 5.74.1, 6.24.0