Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-44889WebOb: Location header normalization during redirect leads to open redirectPyPI · webob · fixed in 1.8.10
- CVE-2026-48109MessagePack-CSharp: LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad inputNuGet · messagepack · fixed in 2.5.301, 3.1.7
- CVE-2026-48502MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflowsNuGet · messagepack · fixed in 3.1.7
- CVE-2026-48506MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depthNuGet · messagepack · fixed in 2.5.301, 3.1.7
- CVE-2026-48509MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodiesNuGet · messagepack · fixed in 2.5.301, 3.1.7
- CVE-2026-48510MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengthsNuGet · messagepack · fixed in 2.5.301, 3.1.7
- CVE-2026-48511MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted mapsNuGet · messagepack · fixed in 2.5.301, 3.1.7
- CVE-2026-48512MessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcementNuGet · messagepack · fixed in 2.5.301, 3.1.7
- CVE-2026-48513MessagePack-CSharp: DynamicUnionResolver generated deserializers miss depth enforcementNuGet · messagepack · fixed in 2.5.301, 3.1.7
- CVE-2026-48514MessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte lengthNuGet · messagepack · fixed in 2.5.301, 3.1.7
- CVE-2026-48515MessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensionsNuGet · messagepack · fixed in 2.5.301, 3.1.7
- CVE-2026-48516MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settingsNuGet · messagepack · fixed in 2.5.301, 3.1.7
- CVE-2026-56698Nuxt - Cross-Site Scripting via navigateTo open Optionnpm · nuxt · fixed in 4.4.7, 3.21.7
- CVE-2026-56697Nuxt - Open Redirect via Protocol-Relative Paths in reloadNuxtAppnpm · nuxt · fixed in 4.4.7, 3.21.7
- CVE-2026-56357n8n - Webhook Forgery via Missing HMAC-SHA256 Signature Verification in GitHub Webhook Triggernpm · n8n · fixed in 1.123.15, 2.5.0
- CVE-2026-56348n8n - Credential Exfiltration via Allowed HTTP Request Domains Bypass in Dynamic Node Parameters Endpointnpm · n8n · fixed in 2.20.0
- CVE-2026-56326Nuxt - Server-Side Open Redirect via Path-Normalization Bypass in navigateTonpm · nuxt · fixed in 4.4.7, 3.21.7
- CVE-2026-56268Flowise - Cross-Workspace Information Disclosure via chatflows/apikey Endpointnpm · flowise · fixed in 3.1.2
- CVE-2026-56266Crawl4AI - Server-Side Request Forgery via Direct Crawl EndpointsPyPI · crawl4ai · fixed in 0.8.7
- CVE-2025-71358picklescan - Remote Code Execution via idlelib.autocomplete.AutoComplete.get_entityPyPI · picklescan · fixed in 0.0.29
- CVE-2025-71344picklescan - Arbitrary Code Execution via Undetected ensurepip._run_pip FunctionPyPI · picklescan · fixed in 0.0.30
- CVE-2025-71339Picklescan - Arbitrary Code Execution via numpy.f2py.crackfortran._eval_length GadgetPyPI · picklescan · fixed in 0.0.33
- CVE-2026-48517MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic argumentsNuGet · messagepack · fixed in 2.5.301, 3.1.7
- CVE-2026-54911UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()PyPI · ujson · fixed in 5.13.0
- CVE-2026-44311Fabric.js: Improper escaping in fabric.Gradient colorStops leads to XSS in SVG serializationnpm · fabric · fixed in 7.4.0
- CVE-2026-54281Nest: Middleware Bypass on Fastify via Trailing Slashnpm · @nestjs/platform-fastify · fixed in 11.1.24
- CVE-2026-49468LiteLLM: Authentication Bypass via Host Header InjectionPyPI · litellm · fixed in 1.84.0
- CVE-2026-41479Authlib OAuth 2.0 authorization endpoint open redirects to attacker-controlled redirect_uri on unsupported response_typePyPI · authlib · fixed in 1.6.10, 1.7.1
- CVE-2026-45034PhpSpreadsheet: File::prohibitWrappers bypassPackagist · phpoffice/phpspreadsheet · fixed in 1.30.5
- CVE-2026-54651pypdf: Possible infinite loop when processing threads/articles in writerPyPI · pypdf · fixed in 6.13.1