Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-54082veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFsMaven · org.verapdf:validation-model, org.verapdf:validation-model-jakarta · fixed in 1.30.2, 1.31.71
- CVE-2026-54078veraPDF Validation XXE via Rich TextMaven · org.verapdf:validation-model, org.verapdf:validation-model-jakarta · fixed in 1.30.2, 1.31.71
- CVE-2026-54079veraPDF Validation XXE via XFAMaven · org.verapdf:validation-model, org.verapdf:validation-model-jakarta · fixed in 1.30.2, 1.31.71
- CVE-2026-54666swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodiesnpm · swagger-typescript-api · fixed in 13.12.2
- CVE-2026-54664swagger-typescript-api vulnerable to code injection via unescaped enum string valuesnpm · swagger-typescript-api · fixed in 13.12.2
- CVE-2026-54661swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client templatenpm · swagger-typescript-api · fixed in 13.12.2
- CVE-2026-54663swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`npm · swagger-typescript-api · fixed in 13.12.2
- CVE-2026-54662swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client templatenpm · swagger-typescript-api · fixed in 13.12.2
- CVE-2026-54660swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`npm · swagger-typescript-api · fixed in 13.12.2
- CVE-2026-67214nanoid Infinite Loop via Negative Size in non-secure modulenpm · nanoid · fixed in 3.3.16, 5.1.16
- CVE-2026-67213nanoid before 5.1.6 Infinite Loop via Zero Size in customAlphabet and customRandomnpm · nanoid · fixed in 3.3.18, 5.1.6
- CVE-2026-56822Netty: TOCTOU in OcspServerCertificateValidatorMaven · io.netty:netty-handler-ssl-ocsp · fixed in 4.2.16.Final, 4.1.136.Final
- CVE-2026-56821Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidatorMaven · io.netty:netty-handler-ssl-ocsp · fixed in 4.2.16.Final, 4.1.136.Final
- CVE-2026-59921Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoderMaven · io.netty:netty-codec-http · fixed in 4.2.16.Final, 4.1.136.Final
- CVE-2026-54659Pagy I18n locale option is not validated before being used in a file pathRubyGems · pagy · fixed in 43.5.6
- CVE-2026-54650openhole-server vulnerable to path traversal via URL-decoded request pathGo · github.com/bablilayoub/openhole · fixed in 0.1.2
- CVE-2026-54658@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL executionnpm · @hypequery/clickhouse · fixed in 2.5.1
- CVE-2026-54638td has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.DecodeGo · github.com/gotd/td · fixed in 0.145.1
- CVE-2026-47219find-my-way is Vulnerable to DDoS with HTTP2npm · find-my-way · fixed in 9.7.0
- CVE-2026-66064goshs has ACL Bypass & Path TraversalGo · github.com/patrickhener/goshs, github.com/patrickhener/goshs/v2 +2 · fixed in 2.1.5-0.20260727065949-f3ef599e4091
- CVE-2026-66063goshs has a Path Traversal issueGo · github.com/patrickhener/goshs, github.com/patrickhener/goshs/v2 +2 · fixed in 2.1.5-0.20260727065949-f3ef599e4091
- CVE-2026-64863goshs --no-delete WebDAV MOVE bypass allows file deletion/overwriteGo · github.com/patrickhener/goshs, github.com/patrickhener/goshs/v2 +2 · fixed in 2.1.4
- CVE-2026-54719goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of CVE-2026-40189)Go · github.com/patrickhener/goshs, github.com/patrickhener/goshs/v2 +2 · fixed in 2.1.1
- CVE-2026-62325goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)Go · github.com/patrickhener/goshs/v2, goshs.de/goshs +1 · fixed in 2.1.4
- CVE-2026-55389datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`PyPI · datamodel-code-generator · fixed in 0.62.0
- CVE-2026-54653`datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema fieldPyPI · datamodel-code-generator · fixed in 0.60.2
- CVE-2026-55391datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebindingPyPI · datamodel-code-generator · fixed in 0.63.0
- CVE-2026-54656`datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-template-dataPyPI · datamodel-code-generator · fixed in 0.60.2
- CVE-2026-54690datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)PyPI · datamodel-code-generator · fixed in 0.61.0
- CVE-2026-55415datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statementsPyPI · datamodel-code-generator · fixed in 0.64.0