Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-44705tmp: Path Traversal via unsanitized prefix/postfix enables directory escapenpm · tmp · fixed in 0.2.6
- CVE-2026-44486Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connectionnpm · axios · fixed in 1.16.0, 0.32.0
- CVE-2026-44487Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapternpm · axios · fixed in 1.16.0, 0.32.0
- CVE-2026-44488Axios: Allocation of Resources Without Limits or Throttling in axiosnpm · axios · fixed in 1.16.0
- CVE-2026-44490Axios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functionsnpm · axios · fixed in 1.16.0, 0.32.0
- CVE-2026-44496Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injectionnpm · axios · fixed in 1.16.0, 0.32.0
- CVE-2026-44495Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Mergenpm · axios · fixed in 1.15.2, 0.31.1
- CVE-2026-44494Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`npm · axios · fixed in 1.16.0
- CVE-2026-44489Axios: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fixnpm · axios · fixed in 1.16.0
- CVE-2026-44492Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)npm · axios · fixed in 1.16.0, 0.32.0
- CVE-2026-11816Path Traversal in keras-team/kerasPyPI · keras · fixed in 3.14.0
- CVE-2026-53723guzzlehttp/guzzle-services' XML Request Serialization Vulnerable to XML Injection via CDATA TerminatorPackagist · guzzlehttp/guzzle-services · fixed in 1.5.4
- CVE-2026-49214guzzlehttp/psr7 has CRLF Injection via URI Host ComponentPackagist · guzzlehttp/psr7 · fixed in 2.10.2
- CVE-2026-48998guzzlehttp/psr7 has Host Confusion via Authority ReinterpretationPackagist · guzzlehttp/psr7 · fixed in 2.10.2
- CVE-2026-5497Unbounded Frame Count in video/jpeg Base64 Data URL Processing Leads to OOM DoS in vllm-project/vllmPyPI · vllm · fixed in 0.19.0
- CVE-2026-41856Spring GraphQL Annotation Detection VulnerabilityMaven · org.springframework.graphql:spring-graphql · fixed in 2.0.4, 1.4.6
- CVE-2026-41700Cross-Site WebSocket Hijacking in Spring for GraphQLMaven · org.springframework.graphql:spring-graphql · fixed in 2.0.4, 1.4.6
- CVE-2026-41699Unsafe Deserialization in Spring GraphQLMaven · org.springframework.graphql:spring-graphql · fixed in 2.0.4, 1.4.6
- CVE-2026-41001Predictable Temp Directory in Artemis Auto-configurationMaven · org.springframework.boot:spring-boot-autoconfigure · fixed in 4.0.7, 3.5.15
- CVE-2026-41000WSS4J validation does not use configured replay cacheMaven · org.springframework.ws:spring-ws-security · fixed in 5.0.2, 4.1.4
- CVE-2026-40999Spring WS SSRF via unvalidated WS-Addressing reply destinationsMaven · org.springframework.ws:spring-ws-core · fixed in 5.0.2, 4.1.4
- CVE-2026-40998Jaxp13 XPath XXE via StreamSource and SAXSourceMaven · org.springframework.ws:spring-xml · fixed in 5.0.2, 4.1.4
- CVE-2026-40997SOAP security faults leak Spring Security account stateMaven · org.springframework.ws:spring-ws-security · fixed in 5.0.2, 4.1.4
- CVE-2026-40996Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by defaultMaven · org.springframework.ws:spring-ws-security · fixed in 5.0.2, 4.1.4
- CVE-2026-40995X.509 authentication bypasses Spring Security account checksMaven · org.springframework.ws:spring-ws-security · fixed in 5.0.2, 4.1.4
- CVE-2026-40994Wss4jSecurityInterceptor disables WS-I BSP validation by defaultMaven · org.springframework.ws:spring-ws-security · fixed in 5.0.2, 4.1.4
- CVE-2026-40992Mail Auto-Configuration Does Not Enable SSL Hostname VerificationMaven · org.springframework.boot:spring-boot-starter-mail · fixed in 4.0.7, 3.5.15
- CVE-2026-40987Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalizationMaven · org.springframework.integration:spring-integration-file · fixed in 7.0.5, 6.5.9
- CVE-2026-40986Spring Web Flow JS RemotingHandler renders non-HTML Response as HTMLMaven · org.springframework.webflow:spring-webflow · fixed in 4.0.1, 3.0.2
- CVE-2026-40985Data Binding Vulnerability in Spring Web Flow with Unified EL ParserMaven · org.springframework.webflow:spring-webflow · fixed in 4.0.1, 3.0.2