Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-110737Push Endpoint Returns Permissive CORS HeadersMaven · com.vaadin:flow-server, com.vaadin:vaadin +3 · fixed in 2.13.8, 23.6.16, 24.4.19 and more
- CVE-2026-116891SemanticMediaWiki 4.2.0 before 7.2.1 Reflected XSS via Special:FacetedSearch cstatePackagist · mediawiki/semantic-media-wiki · fixed in 7.2.1
- CVE-2026-116890Semantic MediaWiki 3.0.0 before 7.3.0 Missing Authorization via smwtask APIPackagist · mediawiki/semantic-media-wiki · fixed in 7.3.0
- CVE-2026-116804DOMPurify from 3.4.4 before 3.4.17 SAFE_FOR_TEMPLATES Bypass via Shadow Root Contentnpm · dompurify · fixed in 3.4.17
- CVE-2026-116803DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtreesnpm · dompurify · fixed in 3.4.17
- CVE-2026-116802DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Modenpm · dompurify · fixed in 3.4.17
- CVE-2026-116591compress zstd: Panic on two-block framesGo · github.com/klauspost/compress, github.com/klauspost/compress/zstd · fixed in 1.20.2
- CVE-2026-116590snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWriteMaven · org.xerial.snappy:snappy-java · fixed in 1.1.10.9
- CVE-2026-116589Datadog dd-trace-py: IAST instrumentation can lead to application DOSPyPI · ddtrace · fixed in 4.15.5
- CVE-2026-116588Datadog dd-trace-py: ReDOS in URL query string obfuscationPyPI · ddtrace · fixed in 3.19.9, 4.15.6
- CVE-2026-116587Go JOSE: DoS when parsing JWKs that contain RSA keysGo · github.com/go-jose/go-jose/v3, github.com/go-jose/go-jose/v4 · fixed in 4.1.6
- CVE-2026-116586Go JOSE: Panics in JSON parsingGo · github.com/go-jose/go-jose/v3, github.com/go-jose/go-jose/v4 · fixed in 4.1.5
- CVE-2026-116585Go JOSE: Panic during CBC-HMAC processingGo · github.com/go-jose/go-jose/v3, github.com/go-jose/go-jose/v4 · fixed in 4.1.5
- CVE-2026-116584Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node lengthnpm · seroval · fixed in 1.6.8
- CVE-2026-116583Seroval: Code injection through a typed array's own constructor propertynpm · seroval · fixed in 1.6.11
- CVE-2026-116582Seroval: Script injection through RegExp sources in serialized outputnpm · seroval · fixed in 1.6.10, 1.0.0
- CVE-2026-116581Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS)npm · seroval · fixed in 1.6.8
- CVE-2026-116580Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type checknpm · seroval · fixed in 1.6.8
- CVE-2026-116579Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)PyPI · autobahn · fixed in 26.10.1
- CVE-2026-116578Tornado: Open redirect in RedirectHandler via protocol-relative URLsPyPI · tornado · fixed in 6.6
- CVE-2026-116577Tornado: Quadratic CPU usage when parsing HTTP headers with line foldingPyPI · tornado · fixed in 6.6
- CVE-2026-116576systeminformation: Windows command injection in services() through Unicode quotation marksnpm · systeminformation · fixed in 5.33.16
- CVE-2026-116575Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)npm · mem0ai · fixed in 3.1.6
- CVE-2026-65630Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in joseHex · jose · fixed in 1.11.13
- CVE-2026-65632ECDSA signature length is not validated in jose, allowing signature malleabilityHex · jose · fixed in 1.11.13
- CVE-2026-65631erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of serviceHex · jose · fixed in 1.11.13
- CVE-2026-65629Weak PBKDF2 parameters for password-encrypted private-key export in joseHex · jose · fixed in 1.11.13
- CVE-2026-65628Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key typesHex · jose · fixed in 1.11.13
- CVE-2026-65627Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2Hex · jose · fixed in 1.11.13
- CVE-2026-65626Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in joseHex · jose · fixed in 1.11.13