Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-50195containerd: CRI checkpoint import allows local image tag poisoningGo · github.com/containerd/containerd, github.com/containerd/containerd/v2 · fixed in 2.1.9, 2.2.5, 2.3.2
- CVE-2026-47262containerd image-triggered runtime DoS via unbounded group parsingGo · github.com/containerd/containerd, github.com/containerd/containerd/v2 · fixed in 1.7.33, 2.0.10, 2.1.9 and more
- CVE-2026-46680containerd user ID handling bypass allows runAsNonRoot evasionGo · github.com/containerd/containerd, github.com/containerd/containerd/v2 · fixed in 1.7.32, 2.0.9, 2.2.4 and more
- CVE-2026-54428Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACKMaven · org.apache.httpcomponents.core5:httpcore5-h2 · fixed in 5.4.3, 5.5-beta2
- CVE-2026-54399Apache HttpComponents Core: Unbounded HTTP Header/Line Length in Default ConfigurationMaven · org.apache.httpcomponents.core5:httpcore5 · fixed in 5.4.3, 5.5-beta2
- CVE-2026-12480Arbitrary HDF5 File Read via Virtual Dataset Bypass in keras-team/kerasPyPI · keras · fixed in 3.12.3, 3.15.0
- CVE-2026-57516Ray < 2.56.0 Unsafe Deserialization RCE via WebDataset ReaderPyPI · ray · fixed in 2.56.0
- CVE-2026-58399@acastellon/auth has an authentication bypass via spoofable headers in validateToken()npm · @acastellon/auth · fixed in 2.3.0
- CVE-2026-53488containerd CRI plugin: — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pullGo · github.com/containerd/containerd, github.com/containerd/containerd/v2 · fixed in 1.7.33, 2.0.10, 2.1.9 and more
- CVE-2026-41579runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violationsGo · github.com/opencontainers/runc · fixed in 1.3.6, 1.4.3, 1.5.0-rc.3
- CVE-2026-54903Oj: Integer Overflow in Oj.load 2GB String HandlingRubyGems · oj · fixed in 3.17.3
- CVE-2026-54902Oj: Use-After-Free in Oj::Parser SAJ Long Key CallbackRubyGems · oj · fixed in 3.17.3
- CVE-2026-54901Oj: Use-After-Free in Oj::Parser array_class/hash_class GC MarkingRubyGems · oj · fixed in 3.17.3
- CVE-2026-54900Oj: Negative-Size memcpy in Oj::Parser create_id Attribute HandlingRubyGems · oj · fixed in 3.17.3
- CVE-2026-54898Oj: Use-After-Free in Oj::Parser SAJ Callback via Input MutationRubyGems · oj · fixed in 3.17.3
- CVE-2026-54897Oj : Use-After-Free in Oj::Doc Iterators via Reentrant CloseRubyGems · oj · fixed in 3.17.3
- CVE-2026-54896Oj: Heap Buffer Overflow in Oj.dump Exception Serialization via Large IndentRubyGems · oj · fixed in 3.17.3
- CVE-2026-54592Oj: Stack Buffer Overflow in Oj::Doc#each_child via Deeply Nested InputRubyGems · oj · fixed in 3.17.3
- CVE-2026-54502Oj: Stack Buffer Overflow in Oj.dump via Large IndentRubyGems · oj · fixed in 3.17.3
- CVE-2026-54500Oj: intern.c form_attr has an uninitialized stack readRubyGems · oj · fixed in 3.17.3
- CVE-2026-54899Oj: Use-After-Free in Oj::Parser Symbol Key Cache ToggleRubyGems · oj · fixed in 3.17.2
- CVE-2026-55223c3p0 exposes a deserialization "sink" via JDBC DataSource bean propertiesMaven · com.mchange:c3p0 · fixed in 0.14.0
- CVE-2026-54672electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`npm · app-builder-lib · fixed in 26.15.0
- CVE-2026-54673electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`npm · builder-util-runtime · fixed in 9.7.0
- CVE-2026-57995phpMyFAQ - Privilege Escalation via Missing Self-Rights Constraint in GroupController::updatePermissionsPackagist · phpmyfaq/phpmyfaq, thorsten/phpmyfaq · fixed in 4.1.5
- CVE-2026-56777n8n - AST Validator Bypass in Python Code Nodenpm · n8n · fixed in 2.26.2, 2.25.7
- CVE-2026-56700Grav - Multiple Remote Code Execution Vulnerabilities via Unsafe Unserialize and Command InjectionPackagist · getgrav/grav · fixed in 2.0.0-beta.2
- CVE-2026-56369ImageMagick - Information Disclosure via AES-CTR Nonce Reuse in PasskeyEncipherImageNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.12.0
- CVE-2026-56365ImageMagick - Memory Leak in PNG Encoder via MNG Image WritingNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.12.0
- CVE-2026-56364ImageMagick - Memory Leak in LoadOpenCLDeviceBenchmark() via Malformed XMLNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.2