Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-119210MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server…Maven · org.mariadb.jdbc:mariadb-java-client · fixed in 3.3.7, 3.4.5, 3.5.11
- CVE-2026-119209pypdf: Possible large memory usage when parsing cross-reference streamsPyPI · pypdf · fixed in 6.21.3
- CVE-2026-119208pypdf: Possible long runtimes/large memory usage for encrypted PDF filesPyPI · pypdf · fixed in 6.21.3
- CVE-2026-119207pypdf: Possible large memory usage for exceptions in strict modePyPI · pypdf · fixed in 6.21.3
- CVE-2026-119206pypdf: Possible long runtimes when retrieving page labelsPyPI · pypdf · fixed in 6.21.3
- CVE-2026-119205pypdf: Possible infinite loop when cloning dictionariesPyPI · pypdf · fixed in 6.21.4
- CVE-2026-119204pypdf: Possible large memory usage when parsing page treePyPI · pypdf · fixed in 6.21.4
- CVE-2026-119203pypdf: Possible infinite loop when hitting EOF in standard xref table during trailer searchPyPI · pypdf · fixed in 6.21.4
- CVE-2026-119202@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of servicenpm · @hapi/content, content · fixed in 6.0.3
- CVE-2026-119201Nuxt dev server exposes generated appSecret through Vite file servingnpm · @nuxt/vite-builder · fixed in 4.6.3
- CVE-2026-119200Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routesnpm · @nuxt/nitro-server, nuxt · fixed in 4.6.3
- CVE-2026-119199Nuxt dev server exposes private runtime config through the Nitro dev bundlenpm · @nuxt/vite-builder · fixed in 4.6.3
- CVE-2026-119198Nuxt dev server arbitrary file read through client error reportsnpm · @nuxt/vite-builder · fixed in 4.6.3
- CVE-2026-119197pyasn1: Quadratic-complexity denial of service in binary REAL decodingPyPI · pyasn1 · fixed in 0.6.5
- CVE-2026-119196pyasn1: Quadratic CPU consumption in constructed BIT STRING decodingPyPI · pyasn1 · fixed in 0.6.5
- CVE-2026-119195pyasn1: Quadratic-time denial of service in constructed string and indefinite-length ANY decodingPyPI · pyasn1 · fixed in 0.6.5
- CVE-2026-119194pyasn1: Quadratic CPU use in schemaless BER/CER/DER container decodingPyPI · pyasn1 · fixed in 0.6.5
- CVE-2026-119193PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handlingPackagist · phpunit/phpunit · fixed in 13.4.4
- CVE-2026-119190Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13npm · node-forge · fixed in 1.4.1
- CVE-2026-119188Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake messagenpm · node-forge · fixed in 1.4.1
- CVE-2026-119187Forge: Denial of service in TLS record processing via call stack exhaustionnpm · node-forge · fixed in 1.4.1
- CVE-2026-119186Forge: AES-GCM authentication bypass via unvalidated tagLength optionnpm · node-forge · fixed in 1.4.1
- CVE-2026-118782Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration countnpm · node-forge · fixed in 1.4.1
- CVE-2026-118781Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)npm · node-forge · fixed in 1.4.1
- CVE-2026-118780Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA storenpm · node-forge · fixed in 1.4.1
- CVE-2026-118779Forge: Regular expression denial of service in PEM decoding (pem.decode)npm · node-forge · fixed in 1.4.1
- CVE-2026-118778Forge: TLS client crash when the server sends no certificatenpm · node-forge · fixed in 1.4.1
- CVE-2026-118777Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookienpm · node-forge · fixed in 1.4.1
- CVE-2026-118775Forge: ASN.1 OID first arc truncation in asn1.oidToDernpm · node-forge · fixed in 1.4.1
- CVE-2026-118773Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversalnpm · glob · fixed in 14.0.2