Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-54621`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union descriptionPyPI · datamodel-code-generator · fixed in 0.60.1
- CVE-2026-54655`datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generatorPyPI · datamodel-code-generator · fixed in 0.60.2
- CVE-2026-55403datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemasPyPI · datamodel-code-generator · fixed in 0.63.0
- CVE-2026-54691datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirectsPyPI · datamodel-code-generator · fixed in 0.61.0
- CVE-2026-55390Arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gatePyPI · datamodel-code-generator · fixed in 0.62.0
- CVE-2026-54654`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` fieldPyPI · datamodel-code-generator · fixed in 0.60.2
- CVE-2026-59941Dompdf: Uncontrolled resource consumption based on declared BMP dimensionsPackagist · dompdf/dompdf · fixed in 3.1.6
- CVE-2026-59942Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image BitmapsPackagist · dompdf/dompdf · fixed in 3.1.6
- CVE-2026-49447Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokensGo · github.com/azukaar/cosmos-server · fixed in 0.22.19
- CVE-2026-59943Dompdf: Embedded SVG images can leak existence of files and directories within the filesystemPackagist · dompdf/dompdf · fixed in 3.1.6
- CVE-2026-56722Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URIPackagist · dompdf/dompdf · fixed in 3.1.6
- CVE-2026-55554Dompdf: Chroot Validation BypassPackagist · dompdf/dompdf · fixed in 3.1.6
- CVE-2026-55555Dompdf: File existence oracle via font-face stylesheet declarationPackagist · dompdf/dompdf · fixed in 3.1.6
- CVE-2026-48060Litestar: HTML Injection Through CSRF TokenPyPI · litestar · fixed in 2.22.0
- CVE-2026-49258Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)Go · github.com/juev/nebula-mesh
- CVE-2026-48058nebula-mesh: Session and OIDC state cookies lack the Secure attributeGo · github.com/juev/nebula-mesh · fixed in 0.3.2
- CVE-2026-47768nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs)Go · github.com/juev/nebula-mesh · fixed in 0.3.2
- CVE-2026-59932PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustionPackagist · phpoffice/phpspreadsheet · fixed in 5.8.1, 3.10.7, 2.4.7 and more
- CVE-2026-47726nebula-mesh: GET /api/v1/audit-log discloses all entries to any operatorGo · github.com/juev/nebula-mesh · fixed in 0.3.2
- CVE-2026-47725nebula-mesh: Web UI lacks CSRF tokens on /ui/* mutating endpointsGo · github.com/juev/nebula-mesh · fixed in 0.3.3
- CVE-2026-48025nebula-mesh: Decrypted CA private key persists in heap after signingGo · github.com/forgekeep/nebula-mesh, github.com/juev/nebula-mesh · fixed in 0.3.7
- CVE-2026-59933PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustionPackagist · phpoffice/phpspreadsheet · fixed in 5.8.1, 3.10.7, 2.4.7 and more
- CVE-2026-59931PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelistPackagist · phpoffice/phpspreadsheet · fixed in 5.8.1, 3.10.7, 2.4.7 and more
- CVE-2026-54635pytonapi has a Webhook Custom Path Authentication BypassPyPI · pytonapi · fixed in 2.2.1
- CVE-2026-54609QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwardingnpm · qti-neon
- CVE-2026-54603OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker hostRubyGems · oauth2 · fixed in 2.0.22
- CVE-2026-54605OAuth: Cross-origin token-request redirects can expose signed request metadataRubyGems · oauth · fixed in 1.1.6
- CVE-2026-54620sqlite3-ruby has Use-After-Free in SQLite Aggregate Function CallbacksRubyGems · sqlite3, sqlite3-ruby · fixed in 2.9.5
- CVE-2026-54619sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different ArityRubyGems · sqlite3, sqlite3-ruby · fixed in 2.9.5
- CVE-2026-54332GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoSGo · github.com/gopacket/gopacket · fixed in 1.6.1