Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-47180Zeroconf: Unbounded recursion in DNS compression-pointer decoder allows LAN-local denial of servicePyPI · zeroconf · fixed in 0.149.5
- CVE-2026-53712SCRAM: Silent channel-binding authentication downgrade via unsupported certificate algorithmsMaven · com.ongres.scram:scram-client, com.ongres.scram:scram-common · fixed in 3.3
- CVE-2026-49835Sigstore Timestamp Authority: OOM due to unbounded metric label cardinalityGo · github.com/sigstore/timestamp-authority, github.com/sigstore/timestamp-authority/v2 · fixed in 2.1.0
- CVE-2026-50273Datadog .NET Tracer: Improper parsing of W3C baggage headers may lead to DoSNuGet · datadog.trace, datadog.trace.opentracing · fixed in 3.43.0
- CVE-2026-48009Shopware: Admin Account Takeover via User Recovery Hash ExposurePackagist · shopware/core, shopware/platform · fixed in 6.7.10.1, 6.6.10.18
- CVE-2026-48014Shopware: Admin API ACL Bypass in Order State Transition EndpointsPackagist · shopware/core, shopware/platform · fixed in 6.7.10.1, 6.6.10.18
- CVE-2026-48010Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accountsPackagist · shopware/core, shopware/platform · fixed in 6.7.10.1, 6.6.10.18
- CVE-2026-48016Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-paymentPackagist · shopware/core, shopware/platform · fixed in 6.7.10.1, 6.6.10.18
- CVE-2026-48015Shopware: Stored XSS via SVG file upload — no SVG sanitizationPackagist · shopware/core, shopware/platform · fixed in 6.7.10.1, 6.6.10.18
- CVE-2026-48008Shopware: Privilege Escalation via Sync API Integration Admin Flag BypassPackagist · shopware/core, shopware/platform · fixed in 6.7.10.1, 6.6.10.18
- CVE-2026-54496Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundnesscrates.io · halo2_gadgets, orchard +2 · fixed in 0.5.0, 0.14.0, 0.28.0 and more
- CVE-2026-44722pyzipper: Encryption bypass for small files encrypted with pyzipperPyPI · pyzipper · fixed in 0.4.0
- CVE-2026-49215Symfony UX: CSRF Protection Bypass in symfony/ux-live-component — Accept Header is CORS-SafelistedPackagist · symfony/ux-live-component · fixed in 2.36.0, 3.1.0
- CVE-2026-49216Symfony UX: XSS in symfony/ux-autocomplete via unescaped AJAX response dataPackagist · symfony/ux-autocomplete · fixed in 2.36.0, 3.1.0
- CVE-2026-63309SurrealDB < 3.1.5 Information Disclosure via ORDER BYcrates.io · surrealdb · fixed in 3.1.5
- CVE-2026-49211Symfony UX: Information exposure via unescaped LIKE wildcards in EntitySearchUtilPackagist · symfony/ux-autocomplete · fixed in 2.36.0, 3.1.0
- CVE-2026-49208Symfony UX: Format-less date LiveProps parsed with the permissive DateTime constructorPackagist · symfony/ux-live-component · fixed in 2.36.0, 3.1.0
- CVE-2026-49210Symfony UX: XSS in symfony/ux-live-component via attacker-controlled child component tagPackagist · symfony/ux-live-component · fixed in 2.36.0, 3.1.0
- CVE-2026-49212Symfony UX: LiveComponentHydrator HMAC checksum lacks component and slot bindingPackagist · symfony/ux-live-component · fixed in 2.36.0, 3.1.0
- CVE-2026-49209Symfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requestsPackagist · symfony/ux-live-component · fixed in 2.36.0, 3.1.0
- CVE-2026-62238OpenRemote < 1.26.0 SQL Injection via Crosstab ExportMaven · io.openremote:openremote-manager · fixed in 1.26.0
- CVE-2026-62237Grav < 2.0.4 ReDoS via regex_replace in SandboxPackagist · getgrav/grav · fixed in 2.0.4
- CVE-2026-62232Grav < 2.0.4 2FA Bypass via Secret RegenerationPackagist · getgrav/grav · fixed in 2.0.4
- CVE-2026-62230Grav < 2.0.4 File Access Bypass via Case VariationPackagist · getgrav/grav · fixed in 2.0.4
- CVE-2026-62208OpenClaw < 2026.6.5 Authorization Header Forwarding via SSEnpm · openclaw · fixed in 2026.6.5
- CVE-2026-43977wger IDOR: Authenticated Users Can Read Others' Private Workout Session Data via Template Routine APIPyPI · wger
- CVE-2026-43978wger: Privilege escalation via trainer-login session chaining allows gym trainers to impersonate gym managersPyPI · wger
- CVE-2026-44182Jupyter Enterprise Gateway Has Kubernetes Manifest Injection via Jinja2 Template RenderingPyPI · jupyter-enterprise-gateway · fixed in 3.3.0
- CVE-2026-44181Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection results in Remote Code ExecutionPyPI · jupyter-enterprise-gateway · fixed in 3.3.0
- CVE-2026-44180Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids can be BypassedPyPI · jupyter-enterprise-gateway · fixed in 3.3.0