Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-45077Symfony: Unauthenticated PHP Object Deserialization in MonologBridge server:log ListenerPackagist · symfony/monolog-bridge, symfony/symfony · fixed in 5.4.52, 6.4.40, 7.4.12 and more
- CVE-2026-45065Symfony: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL InjectionPackagist · symfony/routing, symfony/symfony · fixed in 5.4.52, 6.4.40, 7.4.12 and more
- CVE-2026-45067Symfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\AddressPackagist · symfony/mime, symfony/symfony · fixed in 5.4.52, 6.4.40, 7.4.12 and more
- CVE-2026-57108.NET Denial of Service VulnerabilityNuGet · microsoft.netcore.app.runtime.linux-arm, microsoft.netcore.app.runtime.linux-arm64 +6 · fixed in 10.0.10, 9.0.18, 8.0.29
- CVE-2026-56170ASP.NET Core Denial of Service VulnerabilityNuGet · microsoft.aspnetcore.app.runtime.linux-arm, microsoft.aspnetcore.app.runtime.linux-arm64 +10 · fixed in 10.0.6, 9.0.15, 8.0.26
- CVE-2026-59891Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registrynpm · @sigstore/oci · fixed in 0.7.1
- CVE-2026-59888jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategyMaven · com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind · fixed in 2.18.8, 2.21.4, 3.1.4
- CVE-2026-59884pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDsPyPI · pyasn1 · fixed in 0.6.4
- CVE-2026-59885pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of servicePyPI · pyasn1 · fixed in 0.6.4
- CVE-2026-59886pyasn1: Uncontrolled resource consumption when converting decoded REAL valuesPyPI · pyasn1 · fixed in 0.6.4
- CVE-2026-54058Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)PyPI · pillow · fixed in 12.3.0
- CVE-2026-59197Pillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`PyPI · pillow · fixed in 12.3.0
- CVE-2026-59200Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()PyPI · pillow · fixed in 12.3.0
- CVE-2026-59198Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated imagesPyPI · pillow · fixed in 12.3.0
- CVE-2026-59205Pillow: Controlled heap out-of-bounds write in `ImageCmsTransform.apply()` via output mode mismatchPyPI · pillow · fixed in 12.3.0
- CVE-2026-59203Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of servicePyPI · pillow · fixed in 12.3.0
- CVE-2026-59199Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflowPyPI · pillow · fixed in 12.3.0
- CVE-2026-59204Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of servicePyPI · pillow · fixed in 12.3.0
- CVE-2026-55651Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data ExposurePackagist · alextselegidis/easyappointments
- CVE-2026-52841Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google syncPackagist · alextselegidis/easyappointments · fixed in 1.6.1
- CVE-2026-52840Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal networkPackagist · alextselegidis/easyappointments · fixed in 1.6.1
- CVE-2026-52839Easy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization BypassPackagist · alextselegidis/easyappointments · fixed in 1.6.0
- CVE-2026-52838Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSSPackagist · alextselegidis/easyappointments · fixed in 1.6.1
- CVE-2026-52837Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule pagePackagist · alextselegidis/easyappointments
- CVE-2026-15736Multiple SQL/DDL Injection and Arbitrary File Read Vulnerabilities in snowflake-sqlalchemyPyPI · snowflake-sqlalchemy · fixed in 1.11.0
- CVE-2026-15305TYPO3 CMS - Unrestricted File Upload in Form FrameworkPackagist · typo3/cms-form · fixed in 14.3.5
- CVE-2024-7708For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak.Maven · org.eclipse.jetty:jetty-server · fixed in 10.0.23, 11.0.23
- CVE-2026-8384In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admiMaven · org.eclipse.jetty:jetty-util · fixed in 12.0.35, 12.1.9
- CVE-2026-6790In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what pMaven · org.eclipse.jetty:jetty-server · fixed in 12.0.35, 12.1.9
- CVE-2026-10051In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the Maven · org.eclipse.jetty:jetty-server · fixed in 12.0.36, 12.1.10