Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-83525Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller…Maven · org.apache.kafka:kafka-raft · fixed in 4.2.2, 4.3.2
- CVE-2026-56828Shopper: read-only team permissions allow administrator creation and permission escalationPackagist · shopper/framework · fixed in 2.9.2
- CVE-2026-44179XWiki Pro Macros: excerpt-include title and content injection executes codeMaven · com.xwiki.pro:xwiki-pro-macros · fixed in 1.14.5
- CVE-2026-116078HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in BanditHex · bandit · fixed in 1.14.1
- CVE-2026-59179OpenHop: Path Traversal in Flow ID File Operationsnpm · @openhop/server · fixed in 0.3.6
- CVE-2026-59177ESPHome Device Builder allows unauthenticated dashboard access via the HA add-on ingress site bound to all interfacesPyPI · esphome-device-builder · fixed in 1.0.10
- CVE-2026-59176Functype: MCP set_functype_version Package Alias RCE via Unsanitized pnpm install + Dynamic Importnpm · functype-mcp-server · fixed in 1.4.4
- CVE-2026-55369Waline login accepts a non-string email as a match-all MongoDB querynpm · @waline/vercel · fixed in 1.41.0
- RUSTSEC-2026-0415Unbounded memory use on large request bodiescrates.io · juniper_hyper · fixed in 0.10.1
- RUSTSEC-2026-0416Stack overflow on deeply nested GraphQL documentscrates.io · juniper · fixed in 0.17.2
- RUSTSEC-2026-0417Excessive CPU and memory use on crafted GraphQL documentscrates.io · juniper · fixed in 0.17.2
- RUSTSEC-2026-0418libz-sys build script leaks environment variables in the build directorycrates.io · libz-sys · fixed in 1.1.31
- RUSTSEC-2026-0433Quadratic parsing of nested image wikilinks with `ENABLE_WIKILINKS`crates.io · pulldown-cmark · fixed in 0.13.6
- RUSTSEC-2026-0436Panic and unbounded allocation (OOM) in the CFB/OLE2 parser on malformed inputcrates.io · calamine · fixed in 0.38.0
- CVE-2026-101272Incorrect session validation for API-created shredder exportsPyPI · pretix · fixed in 2026.6.4, 2026.7.3, 2026.8.1
- CVE-2026-101274When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate…PyPI · pretix · fixed in 2026.6.4, 2026.7.3, 2026.8.1
- CVE-2026-101273Giftcard enumerationPyPI · pretix · fixed in 2026.6.4, 2026.7.3, 2026.8.1
- CVE-2026-110879jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation…Maven · com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind · fixed in 2.18.12, 2.21.8, 2.22.4 and more
- CVE-2026-110747jackson-dataformat-protobuf: integer overflow in ProtobufParser._readStringKey() allows OutOfMemoryError from an 8-byte payloadMaven · com.fasterxml.jackson.dataformat:jackson-dataformat-protobuf, tools.jackson.dataformat:jackson-dataformat-protobuf · fixed in 2.21.8, 2.22.4, 3.1.8 and more
- CVE-2026-104895jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of serviceMaven · com.fasterxml.jackson.dataformat:jackson-dataformat-smile, tools.jackson.dataformat:jackson-dataformat-smile · fixed in 2.18.12, 2.21.8, 2.22.4 and more
- CVE-2026-104016jackson-dataformat-protobuf: signed integer overflow in string-length paths allows unbounded array allocation and OutOfMemoryErrorMaven · com.fasterxml.jackson.dataformat:jackson-dataformat-protobuf, tools.jackson.dataformat:jackson-dataformat-protobuf · fixed in 2.18.12, 2.21.8, 2.22.4 and more
- CVE-2026-59158Nuxt Ollama: public runtime configuration discloses the configured cloud API keynpm · nuxt-ollama · fixed in 1.3.1
- CVE-2026-97045Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/netGo · golang.org/x/net, golang.org/x/net/html · fixed in 0.62.0
- CVE-2026-78661Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/netGo · golang.org/x/net, golang.org/x/net/html · fixed in 0.62.0
- CVE-2026-116775pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)crates.io · pageant · fixed in 0.2.5
- CVE-2026-116774russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)crates.io · russh · fixed in 0.65
- CVE-2026-116773russh's SSH client is susceptible to unbounded allocations via EXT_INFO packetscrates.io · russh · fixed in 0.65
- CVE-2026-116696russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messagescrates.io · russh · fixed in 0.65.0
- CVE-2026-116695Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypassRubyGems · crass · fixed in 1.0.8
- CVE-2026-116694OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagationPyPI · opentelemetry-propagator-jaeger · fixed in 1.45.0