Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-54282Starlette: Unvalidated request path concatenated into authority poisons request.url.hostnamePyPI · starlette · fixed in 1.3.0
- CVE-2026-54273AIOHTTP: HTTP/1 Pipelined Requests Queue Without LimitPyPI · aiohttp · fixed in 3.14.1
- CVE-2026-54280AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body DisconnectPyPI · aiohttp · fixed in 3.14.1
- CVE-2026-54278AIOHTTP: Unread Compressed Request Bodies Bypass client_max_size During CleanupPyPI · aiohttp · fixed in 3.14.1
- CVE-2026-54277AIOHTTP: C HTTP Parser Bypasses max_line_size for Fragmented LinesPyPI · aiohttp · fixed in 3.14.1
- CVE-2026-54276AIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect ChallengesPyPI · aiohttp · fixed in 3.14.1
- CVE-2026-54275AIOHTTP: TLS Server Hostname Override Is Ignored When Reusing HTTPS ConnectionsPyPI · aiohttp · fixed in 3.14.1
- CVE-2026-54274AIOHTTP: Incomplete websocket frame payloads bypass memory limitsPyPI · aiohttp · fixed in 3.14.1
- CVE-2026-54279AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar PersistencePyPI · aiohttp · fixed in 3.14.1
- CVE-2026-42127Pre-authentication denial of service in the public dashboard query endpointGo · github.com/grafana/grafana · fixed in 1.9.2-0.20260616075434-82ef13993059
- CVE-2026-50269AIOHTTP: CRLF injection in multipart headersPyPI · aiohttp · fixed in 3.14.0
- CVE-2026-54269protobufjs: Schema-derived names can shadow runtime-significant propertiesnpm · protobufjs, protobufjs-cli · fixed in 7.6.3, 8.6.0, 2.5.1 and more
- CVE-2026-48712protobufjs: Denial of service through unbounded Any expansion during JSON conversionnpm · protobufjs · fixed in 7.6.1, 8.4.1
- CVE-2026-54270protobufjs: Memory amplification from preserved unknown fields in binary decodenpm · protobufjs · fixed in 8.5.0
- CVE-2026-54271protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor namesnpm · protobufjs-cli · fixed in 1.3.2, 2.5.0
- CVE-2026-53571Vite: `server.fs.deny` bypass on Windows alternate pathsnpm · vite, vite-plus · fixed in 8.0.16, 7.3.5, 6.4.3 and more
- CVE-2026-49356Babel: Arbitrary File Read via sourceMappingURL Comment in @babel/corenpm · @babel/core · fixed in 8.0.0-rc.6, 7.29.6
- CVE-2026-55602http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypassnpm · http-proxy-middleware · fixed in 3.0.6, 4.1.0, 2.0.10
- CVE-2026-53632NTLMv2 hash disclosure via UNC path handling on Windowsnpm · launch-editor, vite +1 · fixed in 2.14.1, 8.0.16, 7.3.5 and more
- CVE-2026-50171Angular: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)npm · @angular/common · fixed in 22.0.0-rc.2, 20.3.22, 19.2.23 and more
- CVE-2026-12249Canonical ADSys Trust Store Poisoning via Plaintext HTTP Certificate Auto-EnrollmentGo · github.com/ubuntu/adsys · fixed in 0.16.3-0.20250318112551-8b1939f96d38
- CVE-2026-50184Angular: Request Credential & Cache Policy Stripping in Angular Service Workernpm · @angular/service-worker · fixed in 22.0.0-rc.2, 21.2.15, 20.3.22 and more
- CVE-2026-50169Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilitiesnpm · @angular/service-worker · fixed in 22.0.0-rc.2, 20.3.22, 19.2.23 and more
- CVE-2026-46417Angular: SSRF via Hostname Hijacking in @angular/platform-servernpm · @angular/platform-server · fixed in 22.0.0-next.12, 21.2.13, 20.3.21 and more
- CVE-2026-50168Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypassnpm · @angular/platform-server · fixed in 22.0.0-rc.2, 20.3.22, 19.2.23 and more
- CVE-2026-50170Angular: Information Leak via Default Caching of Credentialed Requests in HttpTransferCachenpm · @angular/common · fixed in 22.0.0-rc.2, 20.3.22, 19.2.23 and more
- CVE-2026-50556Angular: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSRnpm · @angular/platform-server · fixed in 22.0.0-rc.2, 21.2.16, 20.3.24 and more
- CVE-2026-50555Angular: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in @angular/platform-servernpm · @angular/platform-server · fixed in 22.0.0-rc.2, 21.2.16, 20.3.24 and more
- CVE-2026-54264Angular: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Workernpm · @angular/service-worker · fixed in 22.0.1, 21.2.17, 20.3.25
- CVE-2026-54268Angular: Denial of Service (DoS) via OOM in Date Formatting (formatDate)npm · @angular/common · fixed in 22.0.1, 21.2.17, 20.3.25