Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-47138Parse Server: Pre-authentication denial of service via client version header regex backtrackingnpm · parse-server · fixed in 9.9.1-alpha.1, 8.6.77
- CVE-2026-47248Parse Server: GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callersnpm · parse-server · fixed in 9.9.1-alpha.2, 8.6.78
- CVE-2026-42306Moby: Race condition in docker cp allows bind mount redirection to host pathGo · github.com/docker/docker, github.com/moby/moby +1 · fixed in 2.0.0-beta.14
- CVE-2026-41568Moby: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swapGo · github.com/docker/docker, github.com/moby/moby +1 · fixed in 2.0.0-beta.14
- CVE-2026-12143form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)npm · form-data · fixed in 2.5.6, 3.0.5, 4.0.6
- CVE-2026-44172MariaDB: mysql_real_escape_string() incorrectly handled big5PyPI · mariadb
- CVE-2026-6961CVE-2026-6961: Path traversal via unsanitized FileInfo.Name in Mattermost federation syncGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.17+incompatible, 11.5.5+incompatible, 11.6.1+incompatible and more
- CVE-2026-7387Mattermost group syncable endpoints allow privilege escalation via scheme_adminGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 11.6.1, 11.5.5, 10.11.17 and more
- CVE-2026-6046Plugin bot username conflict allows user account to be used as bot identity in Mattermost ServerGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.17+incompatible, 11.5.5+incompatible, 11.6.1+incompatible and more
- CVE-2026-6689*Missing* {{invite_user}} *permission check on team creation allows unprivileged users to set open-invite and allowed-domains team settings*Go · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.17+incompatible, 11.5.5+incompatible, 11.6.1+incompatible and more
- CVE-2026-7184Mattermost Remote Cluster PATCH API Leaks Authentication TokensGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.16+incompatible, 11.5.5+incompatible, 11.6.1+incompatible and more
- CVE-2026-6739Mattermost: Delegated admins could patch protected default system rolesGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 11.6.1, 11.5.5, 10.11.17 and more
- CVE-2026-3433Mattermost fails to scope role_updated websocket events to authorized team and channel membersGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.17+incompatible, 11.5.5+incompatible, 11.6.1+incompatible and more
- CVE-2026-45833A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary cPyPI · chromadb
- CVE-2026-45831The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a usePyPI · chromadb
- CVE-2026-50560Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signatureMaven · io.netty:netty-codec-http2 · fixed in 4.2.15.Final, 4.1.135.Final
- CVE-2026-46690unbounded-spsc: Sender::send pointer-as-value transmute causes OOB read and fake-Arc drop under TX/RX racecrates.io · unbounded-spsc
- CVE-2026-50020Netty's HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permittedMaven · io.netty:netty-codec-http · fixed in 4.2.15.Final, 4.1.135.Final
- CVE-2026-50011Netty has unbounded pre-allocation in RedisArrayAggregator from RESP array lengthMaven · io.netty:netty-codec-redis · fixed in 4.2.15.Final, 4.1.135.Final
- CVE-2026-50010Netty's wrapping plain trust manager silently disables hostname verificationMaven · io.netty:netty-handler · fixed in 4.2.15.Final, 4.1.135.Final
- CVE-2026-47190IPAM controller service account granted unnecessary full access to SecretsGo · github.com/metal3-io/ip-address-manager · fixed in 1.11.7, 1.12.4
- CVE-2026-50009Netty QUIC stateless reset token material exposed through header-visible connection IDsMaven · io.netty:netty-codec-classes-quic · fixed in 4.2.15.Final
- CVE-2026-45830A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily rPyPI · chromadb
- CVE-2026-48748Netty HTTP/3 QPACK Blocked Streams Memory ExhaustionMaven · io.netty:netty-codec-http3 · fixed in 4.2.15.Final
- CVE-2026-48059Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory ExhaustionMaven · io.netty:netty-codec-haproxy · fixed in 4.2.15.Final, 4.1.135.Final
- CVE-2026-48043netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory ExhaustionMaven · io.netty:netty-codec-http2 · fixed in 4.1.135.Final, 4.2.15.Final
- CVE-2026-48006Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregatorMaven · io.netty:netty-codec-redis · fixed in 4.2.15.Final, 4.1.135.Final
- CVE-2026-47691Netty has Insufficient Bailiwick Validation for NS RecordsMaven · io.netty:netty-resolver-dns · fixed in 4.2.15.Final, 4.1.135.Final
- CVE-2026-47244Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforcedMaven · io.netty:netty-codec-http2 · fixed in 4.2.15.Final, 4.1.135.Final
- CVE-2026-46340Netty: SCTP reassembly nests buffers without boundMaven · io.netty:netty-transport-sctp · fixed in 4.2.15.Final, 4.1.135.Final