Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-45664ImageMagick: Policy Bypass in MNG coder couldNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.13.1
- CVE-2026-46522ImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustionNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.13.1
- CVE-2026-45624ImageMagick: Heap Buffer Over-Read of a 4 bytes in distort operation.NuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.13.1
- CVE-2026-45359ImageMagick: Out-of-Bounds Read in connected components when the user supplies an invalid keep-top defineNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.13.1
- CVE-2026-45358ImageMagick: Out-of-Bounds Read of a single byte in meta encoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.13.1
- CVE-2026-42326ImageMagick: Heap Buffer Over-Read in IPTC encoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.13.1
- CVE-2026-45031ImageMagick: Policy Bypass in PSD decoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.13.1
- CVE-2026-46523ImageMagick: Use-After-Free in MSL decoder.NuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.13.1
- CVE-2026-46625JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injectionnpm · js-cookie · fixed in 3.0.7
- CVE-2026-45783libp2p: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodesnpm · @libp2p/kad-dht · fixed in 16.2.6
- CVE-2026-46679libp2p: Memory DoS via subscription flood of unique topicsnpm · @libp2p/gossipsub · fixed in 15.0.23
- CVE-2026-46689Kanidm: Unauthenticated process abort via SCIM filter stack exhaustioncrates.io · kanidm_proto, scim_proto · fixed in 1.9.3
- CVE-2026-50131Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 rangesnpm · @fedify/fedify, @fedify/vocab-runtime · fixed in 1.9.12, 1.10.11, 2.0.19 and more
- CVE-2026-48110Russh: SSH message fields were decoded through allocation-first parsers before field-specific boundscrates.io · russh · fixed in 0.61.0
- CVE-2026-48108Russh: SSH identification parsing accepted non-canonical client banners and did not bound pre-banner inputcrates.io · russh · fixed in 0.61.0
- CVE-2026-48107Russh: Unchecked keyboard-interactive prompt count in client auth pathcrates.io · russh · fixed in 0.61.0
- CVE-2026-10143kafka-python prior to 2.3.2 DoS via SCRAM Iteration Count in scram.pyPyPI · kafka-python · fixed in 2.3.2
- CVE-2026-42462Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuringnpm · @fedify/fedify · fixed in 2.2.3, 2.1.14, 2.0.18 and more
- CVE-2026-46705russh server userauth state is not reset when authentication principal changescrates.io · russh · fixed in 0.61.0
- CVE-2026-46702Russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packetscrates.io · russh · fixed in 0.61.1
- CVE-2026-46673Russh: Unchecked CryptoVec allocation and growth handling is reachable from local agent inputs in current russh releases and from remote SSH traffic in historical pre-0.58.0 releasescrates.io · russh, russh-cryptovec · fixed in 0.60.3
- CVE-2026-10142kafka-python prior to 2.3.2 Denial of Service via Protocol Parser Frame LengthPyPI · kafka-python · fixed in 2.3.2
- CVE-2026-46668SpiceDB: Caveat structures with nested lists can result in improper cache reuseGo · github.com/authzed/spicedb · fixed in 1.52.0
- CVE-2026-48011Shopware: Timing-attack on admin panel allowing enumeration of administrator usernamesPackagist · shopware/core, shopware/platform · fixed in 6.7.10.1, 6.6.10.18
- CVE-2026-46654Plonky3 MultiField32Challenger: transcript malleability and challenge entropy losscrates.io · p3-challenger · fixed in 0.4.3, 0.5.3
- CVE-2026-44692Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpointPackagist · code16/sharp · fixed in 9.22.0
- CVE-2026-53634Sharp: Missing Authorization Check in Quick Creation Command EndpointsPackagist · code16/sharp · fixed in 9.22.3
- CVE-2026-45106Weblate: Stored HTML injection in editor search previewPyPI · weblate · fixed in 2026.5
- CVE-2026-50127Weblate SSRF: outbound URL guard misses the NAT64 well-known prefix (64:ff9b::/96)PyPI · weblate · fixed in 2026.6
- CVE-2026-46683Snappy: SSRF and local file read via the xsl-style-sheet optionPackagist · knplabs/knp-snappy · fixed in 1.7.0