Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-59946Composer: Path traversal in package bin field lets dependencies chmod arbitrary host filesPackagist · composer/composer · fixed in 2.10.2, 2.2.29
- CVE-2026-59822LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough FallbackPyPI · litellm · fixed in 1.84.0
- CVE-2026-44332Fiber: Username Enumeration via Timing Oracle in BasicAuth Default AuthorizerGo · github.com/gofiber/fiber/v3 · fixed in 3.3.0
- CVE-2026-59820LiteLLM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')PyPI · litellm · fixed in 1.83.7
- CVE-2026-53624Fiber: HSTS header never set in helmet middleware due to incorrect protocol checkGo · github.com/gofiber/fiber, github.com/gofiber/fiber/v3 · fixed in 3.4.0
- CVE-2026-44512ONNX: Null Pointer Dereference in Upsample Version Converter Adapter (Zero Inputs)PyPI · onnx · fixed in 1.22.0
- CVE-2026-55575LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforcenpm · liquidjs · fixed in 10.27.1
- CVE-2026-58501Zeep SSRF because Settings.forbid_external is not enforcedPyPI · zeep · fixed in 4.3.3
- CVE-2026-55760handlebars.java FileTemplateLoader Path TraversalMaven · com.github.jknack:handlebars · fixed in 4.5.2
- CVE-2026-45045Fiber: X-Real-IP Spoofing via Header.Add() in BalancerForwardGo · github.com/gofiber/fiber/v2, github.com/gofiber/fiber/v3 · fixed in 2.52.14, 3.3.0
- CVE-2026-59821LiteLLM: Custom Code Guardrails production endpoints bypass code safety checksPyPI · litellm · fixed in 1.82.0
- CVE-2026-59937pypdf: Possible long runtimes for repeated malformed cross-reference entriesPyPI · pypdf · fixed in 6.14.0
- CVE-2026-59938pypdf: Possible large memory usage for wrong image dimensionsPyPI · pypdf · fixed in 6.14.0
- CVE-2026-59731Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatchnpm · astro · fixed in 6.4.8
- CVE-2026-59927Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown filesPyPI · mistune · fixed in 3.3.0
- CVE-2026-59928Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitionsPyPI · mistune · fixed in 3.3.0
- CVE-2026-59924Mistune: Arbitrary File Read via Include directive path traversalPyPI · mistune · fixed in 3.3.0
- CVE-2026-59929Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` executionPyPI · mistune · fixed in 3.3.0
- CVE-2026-59925inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairsPyPI · mistune · fixed in 3.3.0
- CVE-2026-59926Mistune: XSS via unescaped class option in Admonition directivePyPI · mistune · fixed in 3.3.0
- CVE-2026-59923Mistune: XSS via percent-encoded javascript URI bypass in safe_url()PyPI · mistune · fixed in 3.3.0
- CVE-2026-59930Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` contentPyPI · mistune · fixed in 3.3.0
- CVE-2026-59922Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)PyPI · mistune · fixed in 3.3.0
- CVE-2026-59895Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utilitynpm · hono · fixed in 4.12.27
- CVE-2026-59896hono/jsx does not isolate context per request, leading to cross-request data disclosurenpm · hono · fixed in 4.12.27
- CVE-2026-59897Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplicationnpm · hono · fixed in 4.12.27
- CVE-2026-59892OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed headernpm · @opentelemetry/propagator-jaeger · fixed in 2.9.0
- CVE-2026-59890setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+PyPI · setuptools · fixed in 83.0.0
- CVE-2026-59887linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker textnpm · linkify-it · fixed in 5.0.2
- CVE-2026-59883Guzzle: Cookie Disclosure and Injection via IP-Address DomainsPackagist · guzzlehttp/guzzle · fixed in 7.12.3