Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-118257Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messagesnpm · @intlify/core, @intlify/core-base +4 · fixed in 11.4.14, 12.0.0-alpha.5
- CVE-2026-118256Vue I18n: `escapeParameter` does not escape named values when the same call also passes a listnpm · @intlify/core, @intlify/core-base +3 · fixed in 11.4.14, 12.0.0-alpha.5
- CVE-2026-118255Highcharts Grid: javascript: URL in credits.href runs script on clicknpm · @highcharts/dashboards, @highcharts/grid-pro · fixed in 4.0.0, 3.2.0
- CVE-2026-118254Highcharts Grid: pagination language options are parsed as HTMLnpm · @highcharts/grid-lite, @highcharts/grid-pro · fixed in 3.2.0
- CVE-2026-118253Highcharts Dashboards: fullscreen labels are parsed as HTMLnpm · @highcharts/dashboards · fixed in 4.2.3
- CVE-2026-118252Highcharts Dashboards: sidebar component labels are parsed as HTMLnpm · @highcharts/dashboards · fixed in 4.2.3
- CVE-2026-118251Highcharts: javascript: URL in credits.href runs script on clicknpm · highcharts · fixed in 11.4.9, 12.6.1, 13.1.0
- CVE-2026-118250Highcharts: dotted series.keys paths write to Object.prototypenpm · highcharts · fixed in 12.6.1, 13.1.0, 11.4.9
- CVE-2026-118249Highcharts: series column construction writes to Object.prototypenpm · highcharts · fixed in 13.1.0
- CVE-2026-118247Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `proto` as an existing column.npm · @highcharts/dashboards, @highcharts/grid-pro · fixed in 4.2.2, 3.2.0
- CVE-2026-118246Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributesnpm · highcharts · fixed in 11.4.9, 12.6.1, 13.1.0
- CVE-2026-118245Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespacenpm · @highcharts/dashboards · fixed in 4.2.2
- CVE-2026-118244Highcharts Core: AST `DOMParser` fallback assigns unsanitized markup to `innerHTML` during printnpm · highcharts · fixed in 12.6.1, 13.1.0
- CVE-2026-118243Highcharts Dashboards: `proto` data table id writes sync listeners to `Object.prototype`npm · @highcharts/dashboards · fixed in 4.2.2
- CVE-2026-118242Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`npm · @highcharts/grid-lite, @highcharts/grid-pro · fixed in 3.2.0
- CVE-2026-116797Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`npm · @highcharts/dashboards, @highcharts/grid-pro · fixed in 4.0.0, 3.2.0
- CVE-2026-116796Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported chartsnpm · highcharts · fixed in 11.4.9, 12.6.2, 13.1.1
- CVE-2026-116795RE2JS: Quadratic-time denial of service in re2js lookbehind matchingnpm · re2js · fixed in 2.8.7
- CVE-2026-116794russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmationcrates.io · russh · fixed in 0.65
- CVE-2026-114349Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batchesMaven · org.apache.kafka:kafka_2.11, org.apache.kafka:kafka_2.12 +1 · fixed in 2.5.0, 4.0.0
- CVE-2026-112375Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigsMaven · org.apache.kafka:kafka
- CVE-2026-116593Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpointMaven · org.apache.kafka:connect-runtime · fixed in 4.2.2, 4.3.2
- CVE-2026-115644Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST ExtensionsMaven · org.apache.kafka:connect-runtime · fixed in 4.2.2, 4.3.2
- CVE-2026-111551Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocationMaven · org.apache.kafka:kafka-clients, org.apache.kafka:kafka-streams
- CVE-2026-111496Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuationMaven · org.apache.kafka:kafka-streams
- CVE-2026-111115Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsingMaven · org.apache.kafka:kafka
- CVE-2026-111108Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readersMaven · org.apache.kafka:kafka
- CVE-2026-111073Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of…Maven · org.apache.kafka:kafka
- CVE-2026-110985Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configuredMaven · org.apache.kafka:kafka
- CVE-2026-110952Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by defaultMaven · org.apache.kafka:kafka · fixed in 4.4.0