Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-54463websocket-driver: Memory exhaustion via abuse of protocol length headersRubyGems · websocket-driver · fixed in 0.8.1
- CVE-2026-54464websocket-driver: Resource limit bypass via message compressionRubyGems · websocket-driver · fixed in 0.8.1
- CVE-2026-55254NCalc: Denial of Service via Unbounded and Non-Terminating Factorial EvaluationNuGet · ncalc.core, ncalcsync · fixed in 6.1.1
- CVE-2026-45799Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding serviceMaven · com.squareup.wire:wire-runtime, com.squareup.wire:wire-runtime-jvm · fixed in 6.3.0, 7.0.0-alpha03
- CVE-2026-48819Hey API: `buildClientParams` template: prototype chain substitution via unknown `$<slot>___proto__` keynpm · @hey-api/openapi-ts · fixed in 0.97.3
- CVE-2026-50289systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linuxnpm · systeminformation · fixed in 5.31.7
- CVE-2026-50151oras-go: credential forwarding via unvalidated Location header in blob uploadGo · oras.land/oras-go/v2 · fixed in 2.6.1
- CVE-2026-50162oras-go: file store write outside workingDir via symlink traversalGo · oras.land/oras-go/v2 · fixed in 2.6.1
- CVE-2026-50163oras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in `oras-go` tar extractionGo · oras.land/oras-go/v2 · fixed in 2.6.2
- CVE-2026-48978oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokensGo · oras.land/oras-go, oras.land/oras-go/v2 · fixed in 2.6.1
- CVE-2026-50197Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding: chunked / HTTP/2 requestsGo · github.com/zalando/skipper · fixed in 0.26.10
- CVE-2026-49834sigstore-go: Multi-log threshold bypass via single compromised logGo · github.com/sigstore/sigstore-go · fixed in 1.2.0
- CVE-2026-49284SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking `SubjectConfirmationData/InResponseTo`Packagist · simplesamlphp/simplesamlphp · fixed in 2.5.2, 2.4.7
- CVE-2026-49852joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)PyPI · joserfc · fixed in 1.6.8
- CVE-2026-45704Pimcore: CustomReports Share BypassPackagist · pimcore/pimcore · fixed in 12.3.6, 11.5.17, 2026.1.2
- CVE-2026-44739Pimcore: SQL Injection in Custom Reports Column ConfigurationPackagist · pimcore/pimcore · fixed in 2026.1.2, 11.5.17, 12.3.6
- CVE-2026-45260Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handlingPackagist · pimcore/pimcore · fixed in 12.3.7, 2026.1.3, 11.5.17
- CVE-2026-8505Authentication Bypass in Webhook Endpoints Allowed Unauthorized Flow ExecutionPyPI · langflow · fixed in 1.9.1
- CVE-2026-45703Pimcore: WordExport Authorization Bypass for Unauthorized Document ExportPackagist · pimcore/pimcore · fixed in 12.3.7, 11.5.17, 2026.1.3
- CVE-2026-45162Pimcore: Unsafe PHP Deserialization in Multiple Locations Without allowed_classes RestrictionPackagist · pimcore/pimcore · fixed in 12.3.7, 11.5.17, 2026.1.3
- GHSA-RJWR-M7QX-3FJRoapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable CodeGo · github.com/oapi-codegen/oapi-codegen/v2 · fixed in 2.7.1
- CVE-2026-58195Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into execSyncnpm · agentic-flow · fixed in 2.0.14
- CVE-2026-45309AsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal usernamePyPI · asyncssh · fixed in 2.23.0
- CVE-2026-50185RustCrypto Cmov/CmovEq on aarch64 can produce wrong results if high-bits of registers are setcrates.io · cmov · fixed in 0.5.4
- CVE-2026-52746JSONata: Malicious inputs to "$toMillis" function can cause resource exhaustionnpm · jsonata · fixed in 2.2.0, 1.8.9
- CVE-2026-48487Zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packetPyPI · zeroconf · fixed in 0.149.16
- CVE-2026-48045Zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source floodPyPI · zeroconf · fixed in 0.149.12
- CVE-2026-47184Zeroconf: Unbounded DNS record cache allows LAN-local memory exhaustion via multicast floodPyPI · zeroconf · fixed in 0.149.7
- CVE-2026-47183Zeroconf: Unbounded exception-dedup state retains packet buffers via traceback frame locals, enabling LAN-local memory exhaustionPyPI · zeroconf · fixed in 0.149.6
- CVE-2026-47180Zeroconf: Unbounded recursion in DNS compression-pointer decoder allows LAN-local denial of servicePyPI · zeroconf · fixed in 0.149.5