Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-46454Apache Camel: Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headersMaven · org.apache.camel:camel-cometd · fixed in 4.14.8, 4.18.3, 4.21.0
- CVE-2026-46453Apache Camel: Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and operationMaven · org.apache.camel:camel-elasticsearch-rest-client · fixed in 4.14.8, 4.18.3, 4.21.0
- CVE-2026-43865Apache Camel: Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code executionMaven · org.apache.camel:camel-hazelcast · fixed in 4.14.8, 4.18.3, 4.21.0
- CVE-2026-42527Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosureMaven · org.apache.camel:camel-amqp, org.apache.camel:camel-cassandraql +10 · fixed in 4.14.8, 4.18.3, 4.21.0
- CVE-2026-40859Apache Camel: Camel-Vertx-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabledMaven · org.apache.camel:camel-netty-http, org.apache.camel:camel-vertx-http · fixed in 4.14.8, 4.18.3, 4.20.0
- CVE-2026-40047Apache Camel: Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducerMaven · org.apache.camel:camel-docling · fixed in 4.18.3
- CVE-2026-14802react create-react-app react-dev-utils openBrowser.js startBrowserProcess os command injectionnpm · react-dev-utils
- CVE-2026-14794Craft CMS Charts Endpoint ChartsController.php actionGetNewUsersData improper authorizationPackagist · craftcms/cms · fixed in 4.18.1, 5.10.3
- CVE-2026-14793Craft CMS reorder-sets Endpoint GlobalsController.php actionReorderSets authorizationPackagist · craftcms/cms · fixed in 4.18.1, 5.10.3
- CVE-2026-14722tiddly-gittly TidGi-Desktop Git Repository Import loadWikiTiddlersWithSubWikis.ts code injectionnpm · tidgi
- CVE-2026-14535Fickling MLAllowlist analysis pass rendered inoperative by shared mutable state in AnalysisContext.shorten_code()PyPI · fickling · fixed in 0.1.12
- CVE-2026-14534Fickling check_safety() bypass via unlisted standard library modules (_posixsubprocess, site, atexit)PyPI · fickling · fixed in 0.1.11
- CVE-2025-71380n8n - Arbitrary Command Execution via Execute Command Nodenpm · n8n, n8n-nodes-base
- CVE-2025-71375picklescan - Undetected Remote Code Execution via _operator.methodcallerPyPI · picklescan · fixed in 0.0.34
- CVE-2025-71373picklescan - Remote Code Execution via operator.methodcaller Detection BypassPyPI · picklescan · fixed in 0.0.33
- CVE-2025-71372Picklescan - Arbitrary Code Execution via numpy.f2py.crackfortran.getlincoef GadgetPyPI · picklescan · fixed in 0.0.33
- CVE-2025-71369picklescan - Unsafe Deserialization via torch.utils.data.datapipes.utils.decoder.basichandlersPyPI · picklescan · fixed in 0.0.28
- CVE-2025-71367picklescan - Remote Code Execution via _operator.attrgetter Detection BypassPyPI · picklescan · fixed in 0.0.34
- CVE-2025-71366picklescan - Arbitrary Code Execution via torch.utils.bottleneck.__main__.run_cprofilePyPI · picklescan · fixed in 0.0.28
- CVE-2025-71364picklescan - Arbitrary Code Execution via Undetected asyncio.unix_events._UnixSubprocessTransport._startPyPI · picklescan · fixed in 0.0.30
- CVE-2025-71362picklescan - Arbitrary Code Execution via Unsafe Deserialization in numpy.f2py.crackfortranPyPI · picklescan · fixed in 0.0.33
- CVE-2025-71360picklescan - Remote Code Execution via Undetected idlelib.calltip.get_entityPyPI · picklescan · fixed in 0.0.29
- CVE-2025-71359picklescan - Unsafe Deserialization via lib2to3.pgen2.grammar.Grammar.loadsPyPI · picklescan · fixed in 0.0.29
- CVE-2025-71356picklescan - Arbitrary Code Execution via torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expressionPyPI · picklescan · fixed in 0.0.28
- CVE-2025-71353picklescan - Remote Code Execution via torch._dynamo.guards.GuardBuilder.getPyPI · picklescan · fixed in 0.0.28
- CVE-2025-71347picklescan - Undetected Remote Code Execution via numpy.f2py.crackfortran.param_evalPyPI · picklescan · fixed in 0.0.33
- CVE-2025-71345picklescan - Arbitrary Code Execution via torch.utils.bottleneck.__main__.run_autograd_profPyPI · picklescan · fixed in 0.0.30
- CVE-2025-71343picklescan - Arbitrary Code Execution via lib2to3.pgen2.pgen.ParserGenerator.make_label Detection BypassPyPI · picklescan · fixed in 0.0.30
- CVE-2025-71342picklescan - Undetected Remote Code Execution via idlelib.run.Executive.runcodePyPI · picklescan · fixed in 0.0.30
- CVE-2026-12252Untrusted JAR Code Execution in Multiple Stanford Interface Classes in nltk/nltkPyPI · nltk · fixed in 3.9.4