Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-46645SQLAdmin: Authorization Bypass on `ajax_lookup`PyPI · sqladmin · fixed in 0.25.1
- CVE-2026-46695BoxLite: Permission Bypass in boxlite Allows Modification of Read-Only Filesnpm · @boxlite-ai/boxlite · fixed in 0.9.0
- CVE-2026-46703BoxLite: Path Traversal Vulnerability in boxlite Leads to Arbitrary File Write on the Hostnpm · @boxlite-ai/boxlite · fixed in 0.9.0
- CVE-2026-47213BoxLite: Timeout Bypass VulnerabilityPyPI · boxlite
- CVE-2026-42568Yamcs Vulnerable to LDAP Injection in LdapAuthModuleMaven · org.yamcs:yamcs-core · fixed in 5.12.7
- CVE-2026-52726Dulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse_submodules=True) yields RCE via attacker-dropped .git/hooks payloadPyPI · dulwich · fixed in 1.2.5
- CVE-2026-47734Dulwich has unbounded memory allocation in receive-pack from crafted thin packsPyPI · dulwich · fixed in 1.2.5
- CVE-2026-53465ImageMagick: Heap Buffer Over-Write in SF3 encoder when writing multi-frame imageNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.14.0
- CVE-2026-53464ImageMagick: Memory Leak in wand option parser when providing invalid argumentsNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.14.0
- CVE-2026-53463ImageMagick: Null Pointer Dereference in distort operation when passing incorrect argumentsNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.14.0
- CVE-2026-53462ImageMagick: Use-After-Free when allocation in CheckPrimitiveExtent failsNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.14.0
- CVE-2026-53461ImageMagick: Out-of-bounds write in ICON decoder due to incorrect loopNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.14.0
- CVE-2026-53460ImageMagick: Policy Bypass can trigger out-of-Memory conditionNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.14.0
- CVE-2026-47712Dulwich doesn't sanitize commit subjects in `porcelain.format_patch`PyPI · dulwich · fixed in 1.2.5
- CVE-2026-49219ImageMagick: Policy Bypass can read disallowed filesNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.14.0
- CVE-2026-49218ImageMagick: Policy Bypass in DCM decoder could result in image with invalid dimensionsNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.14.0
- CVE-2026-48994ImageMagick: Heap Buffer Over-Write in MAT decoder on 32-bit systemsNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.14.0
- CVE-2026-48734ImageMagick: Stack Overflow in MVG decoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.14.0
- CVE-2026-42305Dulwich has an arbitrary file write via NTFS-hostile tree entries on WindowsPyPI · dulwich · fixed in 1.2.5
- CVE-2026-48733ImageMagick: Infinite Loop in subimage-search with crafted imageNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.14.0
- CVE-2026-48724ImageMagick: Heap Buffer Underwrite in Floyd-Steinberg depth ditheringNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.14.0
- CVE-2026-47166ImageMagick: Heap Buffer Over-Read in distributed pixel cache serverNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.12.0
- CVE-2026-47165ImageMagick: Information Disclosure in distributed pixel cache server because it is not using a challenge–response authentication modelNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.12.0
- CVE-2026-46693ImageMagick: Race Condition in distributed pixel cache server can result in file descriptor hijackingNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.12.0
- CVE-2026-42563Dulwich Vulnerable to Command Injection via Merge Driver PathPyPI · dulwich · fixed in 1.2.5
- CVE-2026-46692ImageMagick: Heap Buffer Over-Write in distributed pixel cache serverNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.12.0
- CVE-2026-46559ImageMagick: Heap Buffer Over-Write of a single byte in the JP2 encoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.13.1
- CVE-2026-46557ImageMagick: Stack overflow in fx operationNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.13.1
- CVE-2026-46521ImageMagick: Heap Buffer Over-Write in MIFF encoder when using LZMA compressionNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.13.1
- CVE-2026-46520ImageMagick: Heap Buffer Over-Write in IPL decoder when reading multiple images of different dimensionsNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.13.1