Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-56740JLine: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet NEW-ENVIRON VariablesMaven · org.jline:jline-remote-telnet · fixed in 4.2.1, 4.0.16, 3.30.14
- CVE-2026-56741JLine: Unauthenticated Remote DoS via Unbounded Telnet NAWS Terminal GeometryMaven · org.jline:jline-remote-telnet · fixed in 4.2.1, 4.0.16, 3.30.14
- CVE-2026-48049@hapi/inert: Static-file confinement bypass via sibling-prefix pathnpm · @hapi/inert · fixed in 7.1.1
- CVE-2026-48022@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirectsnpm · @hapi/wreck · fixed in 18.1.2
- CVE-2026-44979@hapi/wreck : Sensitive `Proxy-Authorization` header leaked across cross-hostname redirectsnpm · @hapi/wreck · fixed in 18.1.1
- CVE-2026-49485HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP EndpointMaven · ca.uhn.hapi.fhir:org.hl7.fhir.dstu2, ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may +6 · fixed in 6.9.9, 6.9.4.2
- CVE-2026-54335Feathersjs: Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__npm · @feathersjs/commons · fixed in 5.0.45
- CVE-2026-54490websocket-driver: Resource limit bypass via message compressionnpm · websocket-driver · fixed in 0.7.5
- CVE-2026-54466websocket-driver: Message corruption via abuse of protocol length headersnpm · websocket-driver · fixed in 0.7.5
- CVE-2026-55518Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege EscalationRubyGems · avo · fixed in 3.32.1, 4.0.0.beta.51
- CVE-2026-54498view_component: around_render HTML-Safety BypassRubyGems · view_component · fixed in 4.12.0
- CVE-2026-54497view_component: Reused Component Instances Retain Stale Render ContextRubyGems · view_component · fixed in 4.12.0
- CVE-2026-50271dd-trace-py: Improper parsing of W3C baggage headers may lead to DoSPyPI · ddtrace · fixed in 4.8.2
- CVE-2026-50274dd-trace-go: Improper parsing of W3C baggage headers may lead to DoSGo · github.com/datadog/dd-trace-go, github.com/datadog/dd-trace-go/v2 · fixed in 2.8.1
- CVE-2026-54159ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCEPackagist · prestashop/ps_facetedsearch · fixed in 4.0.4
- CVE-2026-45785OpenMcdf: Uncatchable infinite loop in DirectoryTree.TryGetDirectoryEntry on crafted CFB directory cycleNuGet · openmcdf · fixed in 3.1.4
- CVE-2026-48062CodeIgniter: Uploaded file extension validation bypass in `ext_in` rulePackagist · codeigniter4/framework · fixed in 4.7.3
- CVE-2026-53727css_parser: SSRF and Local File Disclosure in `CssParser::Parser#read_remote_file`RubyGems · css_parser · fixed in 3.0.0
- CVE-2026-50272dd-trace: Improper parsing of W3C baggage headers may lead to DoSnpm · dd-trace · fixed in 5.100.0
- CVE-2026-45784rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD cipherscrates.io · openssl · fixed in 0.10.80
- CVE-2026-54243Statamic: CSV formula injection in form submission exportsPackagist · statamic/cms · fixed in 6.20.1, 5.73.24
- CVE-2026-54242Statamic: Server-Side Request Forgery via Glide (DNS rebinding)Packagist · statamic/cms · fixed in 5.73.24, 6.20.1
- CVE-2026-54244Statamic: Incorrect authorization lets view-only users submit Live Preview content reserved for editorsPackagist · statamic/cms · fixed in 5.74.0, 6.20.3
- CVE-2026-49977tarteaucitron.js: data-cookie attribute can be used to delete arbitrary cookiesnpm · tarteaucitronjs · fixed in 1.33.0
- CVE-2026-54163secure_headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted inputRubyGems · secure_headers · fixed in 7.3.0
- CVE-2026-44891Netty: Denial of Service via Unbounded Headers in StompSubframeDecoderMaven · io.netty:netty-codec-stomp · fixed in 4.2.16.Final, 4.1.136.Final
- CVE-2026-48504OpenTelemetry Rust: Unbounded memory allocation in W3C Baggage propagationcrates.io · opentelemetry_sdk · fixed in 0.32.1
- CVE-2026-44974Parameter smuggling in @hapi/content header parser allows upload-filter bypass via duplicate parametersnpm · @hapi/content · fixed in 6.0.2
- CVE-2026-54171Excon: redact additional sensitive/risky headers when following redirectsRubyGems · excon · fixed in 1.5.0
- CVE-2026-54465websocket-driver: Memory exhaustion in HTTP header parserRubyGems · websocket-driver · fixed in 0.8.1