Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-49854Tornado: Out-of-bounds memory access in C extensionPyPI · tornado · fixed in 6.5.6
- CVE-2026-49853Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClientPyPI · tornado · fixed in 6.5.6
- CVE-2026-48816sigstore-js: Insufficient Verification of Data Authenticitynpm · @sigstore/verify · fixed in 3.1.1
- CVE-2026-48758sigstore-js: DSSE payloadType type-binding failurenpm · @sigstore/core · fixed in 3.2.1
- CVE-2026-48815sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforcednpm · sigstore · fixed in 4.1.1
- CVE-2026-53486decompress: Archive extraction can create files and links outside the target directorynpm · @xhmikosr/decompress, decompress · fixed in 10.2.1, 11.1.3
- CVE-2026-48801linkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan loopnpm · linkify-it · fixed in 5.0.1
- CVE-2026-49978DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.contentnpm · dompurify · fixed in 3.4.7
- CVE-2026-49459DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOMnpm · dompurify · fixed in 3.4.6
- CVE-2026-49458DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checksnpm · dompurify · fixed in 3.4.6
- CVE-2026-59889jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserializationMaven · com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind · fixed in 2.21.5, 2.18.9, 2.22.1 and more
- CVE-2026-47423DOMPurify XSS via `selectedcontent` re-clonenpm · dompurify · fixed in 3.4.5
- CVE-2026-47736Puma PROXY Protocol v1 Parser Allows Remote Memory ExhaustionRubyGems · puma · fixed in 8.0.2, 7.2.1
- CVE-2026-47737Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent ConnectionsRubyGems · puma · fixed in 8.0.2, 7.2.1
- CVE-2026-48069@grpc/grps-js: An incoming malformed compressed message can cause a client or server crashnpm · @grpc/grpc-js · fixed in 1.9.16, 1.10.12, 1.11.4 and more
- CVE-2026-50659.NET Spoofing VulnerabilityNuGet · microsoft.netcore.app.runtime.linux-arm, microsoft.netcore.app.runtime.linux-arm64 +10 · fixed in 10.0.10, 9.0.18, 8.0.29
- CVE-2026-50651.NET Denial of Service VulnerabilityNuGet · microsoft.netcore.app.runtime.linux-arm, microsoft.netcore.app.runtime.linux-arm64 +10 · fixed in 10.0.10, 9.0.18, 8.0.29
- CVE-2026-48068@grpc/grps-js: A malformed request can cause a server crashnpm · @grpc/grpc-js · fixed in 1.9.16, 1.10.12, 1.11.4 and more
- CVE-2026-53633Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCEnpm · @vitest/browser, vite-plus · fixed in 5.0.0-beta.4, 4.1.8, 3.2.5 and more
- CVE-2026-47428Vitest browser mode serves unsanitized otelCarrier query parameter as inline scriptnpm · @vitest/browser · fixed in 4.1.6, 5.0.0-beta.3
- CVE-2026-50650.NET Framework Elevation of Privilege VulnerabilityNuGet · microsoft.windowsdesktop.app.runtime.win-arm64, microsoft.windowsdesktop.app.runtime.win-x64 +1 · fixed in 10.0.10, 9.0.18, 8.0.29
- CVE-2026-50648.NET Framework Denial of Service VulnerabilityNuGet · system.security.cryptography.xml · fixed in 10.0.10, 9.0.18, 8.0.4
- CVE-2026-50646.NET Framework Remote Code Execution VulnerabilityNuGet · microsoft.windowsdesktop.app.runtime.win-arm64, microsoft.windowsdesktop.app.runtime.win-x64 +1 · fixed in 10.0.10, 9.0.18, 8.0.29
- CVE-2026-50528.NET Security Feature Bypass VulnerabilityNuGet · microsoft.netcore.app.runtime.linux-arm, microsoft.netcore.app.runtime.linux-arm64 +10 · fixed in 10.0.10, 9.0.18, 8.0.29
- CVE-2026-50527.NET Framework Denial of Service VulnerabilityNuGet · system.security.cryptography.xml · fixed in 10.0.10, 9.0.18, 8.0.4
- CVE-2026-50526.NET Tampering VulnerabilityNuGet · microsoft.net.build.containers · fixed in 10.0.10, 9.0.18, 8.0.29
- CVE-2026-50525.NET Denial of Service VulnerabilityNuGet · system.security.cryptography.xml · fixed in 10.0.10, 9.0.18, 8.0.4
- CVE-2026-50524.NET Framework Denial of Service VulnerabilityNuGet · microsoft.netcore.app.runtime.linux-arm, microsoft.netcore.app.runtime.linux-arm64 +10 · fixed in 10.0.10, 9.0.18, 8.0.29
- CVE-2026-47429Vitest: Arbitrary file can be read and executed when Vitest UI server is listeningnpm · vitest · fixed in 4.1.0, 3.2.6
- CVE-2026-48038joi: Uncaught RangeError on deeply nested input through recursive `link()` schemasnpm · joi · fixed in 18.2.1, 17.13.4