Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-50017pnpm binds unscoped user-level npm auth credentials to a repository-selected registrynpm · pnpm · fixed in 10.34.0, 11.4.0
- CVE-2026-50016pnpm: Transitive dependency alias path traversal allows project path override via symlink replacementnpm · pnpm · fixed in 10.34.0, 11.4.0
- CVE-2026-50015pnpm: Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)npm · pnpm · fixed in 10.34.0, 11.4.0
- CVE-2026-50014pnpm: Git Fetch Argument Injection via Lockfile resolution.commitnpm · pnpm · fixed in 10.34.0, 11.4.0
- CVE-2026-50573pnpm: Unsafe default behavior breaks integrity checknpm · pnpm · fixed in 10.34.0, 11.4.0
- CVE-2026-50021pnpm: Integrity Check Bypass via Missing Lockfile Integrity Fieldnpm · pnpm · fixed in 11.4.0, 10.34.1
- CVE-2026-55700pnpm: stage download writes outside destination via manifest version traversalnpm · pnpm · fixed in 11.5.3
- CVE-2026-55699pnpm: reserved bin name deletes PNPM_HOME during global removenpm · pnpm · fixed in 10.34.2, 11.5.3
- CVE-2026-55698pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytesnpm · pnpm · fixed in 10.34.2, 11.5.3
- CVE-2026-55697pnpm: Repository-controlled configDependencies can select a pacquet native install enginenpm · pnpm · fixed in 10.34.2, 11.5.3
- CVE-2026-55487pnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecyclenpm · pnpm · fixed in 10.34.2, 11.5.3
- CVE-2026-54448Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parserGo · github.com/aquasecurity/trivy · fixed in 0.71.0
- CVE-2026-55092Trivy: Path traversal via a crafted vulnerability database or other downloaded artifactsGo · github.com/aquasecurity/trivy · fixed in 0.71.1
- CVE-2026-9083Keycloak: keycloak: information disclosure through arbitrary filesystem path probingMaven · org.keycloak:keycloak-services · fixed in 26.6.4
- CVE-2026-9799Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypassMaven · org.keycloak:keycloak-services · fixed in 26.6.4
- CVE-2026-9705Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access tokenMaven · org.keycloak:keycloak-services · fixed in 26.6.4
- CVE-2026-9086Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypassMaven · org.keycloak:keycloak-services · fixed in 26.6.4
- CVE-2026-9800Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparisonMaven · org.keycloak:keycloak-policy-enforcer, org.keycloak:keycloak-services · fixed in 26.0.10, 26.6.4
- CVE-2026-55477Authenticated Arbitrary File Write via Database Import and Xray Log Path ManipulationGo · github.com/mhsanaei/3x-ui, github.com/mhsanaei/3x-ui/v2 +1 · fixed in 3.3.1
- CVE-2026-57438Nokogiri: Possible Use-After-Free in XInclude ProcessingRubyGems · nokogiri · fixed in 1.19.4
- CVE-2026-57437Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetimeRubyGems · nokogiri · fixed in 1.19.4
- CVE-2026-57436Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node typeRubyGems · nokogiri · fixed in 1.19.4
- CVE-2026-57435Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`RubyGems · nokogiri · fixed in 1.19.4
- CVE-2026-57434Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classesRubyGems · nokogiri · fixed in 1.19.4
- CVE-2026-57235Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`RubyGems · nokogiri · fixed in 1.19.4
- CVE-2026-57234Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247RubyGems · nokogiri · fixed in 1.19.4
- CVE-2026-57236Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exceptionRubyGems · nokogiri · fixed in 1.19.4
- CVE-2026-56091Apache Shiro: Authentication bypass in Guice-Web integrationMaven · org.apache.shiro:shiro-guice · fixed in 3.0.0
- CVE-2026-56130Apache Shiro: Remember-me cookie isn't checked for expiry on the serverMaven · org.apache.shiro:shiro-core, org.apache.shiro:shiro-web · fixed in 3.0.0
- CVE-2026-13311shell-quote parse() is quadratic in token count, enabling denial of servicenpm · shell-quote · fixed in 1.9.0