Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-50734Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire memory-allocation DoS during wire format…Maven · org.apache.activemq:activemq-all, org.apache.activemq:activemq-client +1 · fixed in 5.19.8, 6.2.7
- CVE-2026-50750Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire DoS following fix for CVE-2026-49270Maven · org.apache.activemq:activemq-all, org.apache.activemq:activemq-broker +1 · fixed in 5.19.8, 6.2.7
- CVE-2026-52760Apache ActiveMQ, Apache ActiveMQ Web Console: Stored XSS via Unescaped values in ActiveMQ Web ConsoleMaven · org.apache.activemq:activemq-web-console, org.apache.activemq:apache-activemq +1 · fixed in 5.19.8, 6.2.7
- CVE-2026-53917Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbounded memory allocation in OpenWire property…Maven · org.apache.activemq:activemq-all, org.apache.activemq:activemq-broker +2 · fixed in 5.19.8, 6.2.7
- CVE-2026-54475Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Temporary destination ownership takeoverMaven · org.apache.activemq:activemq-all, org.apache.activemq:activemq-broker +1 · fixed in 5.19.8, 6.2.7
- CVE-2026-13149brace-expansion through 5.0.6 is vulnerable to denial of service.npm · brace-expansion · fixed in 5.0.7, 1.1.16, 2.1.2
- CVE-2026-45822decode-uri-component through 0.4.1 is vulnerable to denial of service.npm · decode-uri-component · fixed in 0.5.0
- CVE-2026-55957Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bindMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 11.0.5, 10.1.37, 9.0.101
- CVE-2026-55956Apache Tomcat: Security constraints for default servlet ignored methodMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 11.0.23, 10.1.56, 9.0.119
- CVE-2026-55955Apache Tomcat: EncryptInterceptor not protected against replay attacksMaven · org.apache.tomcat:tomcat, org.apache.tomcat:tomcat-tribes · fixed in 11.0.23, 10.1.56, 9.0.119
- CVE-2026-55276Apache Tomcat: Logged effective web.xml is incompleteMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 11.0.23, 10.1.56, 9.0.119
- CVE-2026-53434Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM ConnectorMaven · org.apache.tomcat:tomcat-util · fixed in 11.0.23, 10.1.56, 9.0.119
- CVE-2026-53404Apache Tomcat: Bad ornext processing in RewriteValveMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 11.0.23, 10.1.56, 9.0.119
- CVE-2026-50229Apache Tomcat: XSS in number guess exampleMaven · org.apache.tomcat:tomcat · fixed in 11.0.23, 10.1.56, 9.0.119
- CVE-2026-11720Path Traversal in googleapis/mcp-toolbox HTTP Tool URL BuilderGo · github.com/googleapis/mcp-toolbox · fixed in 1.3.0
- CVE-2026-41052Rancher Privilege Escalation from Project Owner to HostGo · github.com/rancher/rancher · fixed in 0.0.0-20260513182521-2800aaac25b5, 2.14.2, 2.13.6 and more
- CVE-2026-55607Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Executionnpm · @anthropic-ai/claude-code · fixed in 2.1.163
- CVE-2026-46406Claude Code: Insecure Temporary File in /copy Command Enables Response Disclosure and Symlink-Based File Writenpm · @anthropic-ai/claude-code · fixed in 2.1.128
- CVE-2026-13676fast-uri vulnerable to host confusion via failed IDN canonicalizationnpm · fast-uri · fixed in 4.0.1, 3.1.3, 2.4.2
- CVE-2026-54351Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Overridenpm · @budibase/server · fixed in 3.39.9
- CVE-2026-54353Budibase: Potential SSRF DNS rebinding bypass in outbound fetch validationnpm · @budibase/backend-core · fixed in 3.39.9
- CVE-2026-54350Budibase: Anonymous NoSQL operator injection via published-app query templatesnpm · @budibase/server · fixed in 3.39.12
- CVE-2026-50137Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentialsnpm · @budibase/server · fixed in 3.39.0
- CVE-2026-50136Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentialsnpm · @budibase/server · fixed in 3.39.2
- CVE-2026-50132Budibase: Chat Identity Link Hijacking via Missing Consent & CSRF — Account Impersonation in Budibasenpm · @budibase/server · fixed in 3.39.0
- CVE-2026-54352Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink uploadnpm · @budibase/server · fixed in 3.39.9
- CVE-2026-46604Panic decoding image with out-of-bounds strip offset in x/image/tiff in golang.org/x/imageGo · golang.org/x/image · fixed in 0.43.0
- CVE-2026-54753Nx: `nx graph` dev server permissive CORS policynpm · nx · fixed in 22.7.2, 23.0.0-beta.2
- CVE-2026-33646mise: Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass)crates.io · mise · fixed in 2026.3.10
- CVE-2026-55441mise: Arbitrary command execution via task-include files in an untrusted, config-less repositorycrates.io · mise · fixed in 2026.6.4