Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-49460pypdf: Inefficient decoding of FlateDecode PNG predictor streamsPyPI · pypdf · fixed in 6.12.2
- CVE-2026-49461pypdf: Possible large memory usage for form XObjects during text extractionPyPI · pypdf · fixed in 6.12.2
- CVE-2026-54531pypdf: Possible infinite loop when processing outlines/bookmarks in writerPyPI · pypdf · fixed in 6.13.0
- CVE-2026-54530pypdf: Possible infinite loop when retrieving fonts for layout-mode text extractionPyPI · pypdf · fixed in 6.13.0
- CVE-2026-47242Net::IMAP: Command Injection via ID command argumentRubyGems · net-imap · fixed in 0.6.4.1, 0.5.15
- CVE-2026-47240Net::IMAP: Command Injection via non-synchronizing literal in "raw" argumentRubyGems · net-imap · fixed in 0.6.4.1, 0.5.15
- CVE-2026-39904Gophish 0.12.1 Denial of Service via Office Document UploadGo · github.com/gophish/gophish
- CVE-2026-47241Net::IMAP: Denial of Service via incomplete raw argument validationRubyGems · net-imap · fixed in 0.6.4.1, 0.5.15
- CVE-2026-55603http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`npm · http-proxy-middleware · fixed in 3.0.7, 4.1.1
- CVE-2026-55599phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information AccessPackagist · phpseclib/phpseclib · fixed in 1.0.30, 2.0.55, 3.0.54
- CVE-2026-44727Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSPPyPI · jupyter-server · fixed in 2.20.0
- CVE-2026-53663React Router: `handleDocumentRequest` CSRF check covers `POST` only; PUT/PATCH/DELETE bypassnpm · @remix-run/server-runtime, react-router · fixed in 2.17.5, 7.15.1
- CVE-2026-54299Astro: Host-header full-read SSRF in core prerendered error-page fetch (prerenderedErrorPageFetch default + unvalidated createRequestFromNodeRequest URL)npm · astro · fixed in 6.4.6
- CVE-2026-54298Astro: XSS via Unescaped Attribute Names in Spread Propsnpm · astro · fixed in 6.4.6
- CVE-2026-50146Astro: Reflected XSS via unescaped slot namenpm · astro · fixed in 6.3.3
- CVE-2026-54300@astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN confignpm · @astrojs/netlify · fixed in 7.0.13
- CVE-2026-54293NLTK: URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File ReadPyPI · nltk · fixed in 3.10.0
- CVE-2026-55443LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loadersPyPI · langchain, langchain-anthropic · fixed in 1.3.9, 1.4.6
- CVE-2026-54288Hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`npm · hono · fixed in 4.12.25
- CVE-2026-54289Hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the restnpm · hono · fixed in 4.12.25
- CVE-2026-54290Hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcardnpm · hono · fixed in 4.12.25
- CVE-2026-54286Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)npm · hono · fixed in 4.12.25
- CVE-2026-54287Hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Latticenpm · hono · fixed in 4.12.25
- CVE-2026-53540Python-Multipart: Negative Content-Length in parse_form buffers the entire body in memoryPyPI · python-multipart · fixed in 0.0.31
- CVE-2026-53537Python-Multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parametersPyPI · python-multipart · fixed in 0.0.30
- CVE-2026-53538Python-Multipart: Semicolon treated as querystring field separator enables parameter smugglingPyPI · python-multipart · fixed in 0.0.30
- CVE-2026-53539Python-Multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of servicePyPI · python-multipart · fixed in 0.0.30
- CVE-2026-54285opentelemetry-js: Unbounded memory allocation in W3C Baggage propagationnpm · @opentelemetry/core · fixed in 2.8.0
- CVE-2026-55388piscina: Prototype Pollution Gadget → RCE via inherited options.filenamenpm · piscina · fixed in 5.2.0, 4.9.3, 6.0.0-rc.2
- CVE-2026-54283Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoSPyPI · starlette · fixed in 1.3.1