Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-41701In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queuesMaven · org.springframework.amqp:spring-amqp · fixed in 4.0.4, 3.2.11
- CVE-2026-46545nimiq-primitives: Panic DoS in trie chunk processing via ROOT-keyed itemcrates.io · nimiq-primitives · fixed in 1.5.0
- CVE-2026-41697Spring Data Relational Parameter not Escaped for Query By Example LIKE PatternMaven · org.springframework.data:spring-data-relational · fixed in 4.0.6, 3.5.12
- CVE-2026-41696Spring Data MongoDB Bind Parameter Literal Quoting BreakoutMaven · org.springframework.data:spring-data-mongodb · fixed in 5.0.6, 4.5.12
- CVE-2026-41695Denial of Service in Spring Data Commons Property Path ResolutionMaven · org.springframework.data:spring-data-commons · fixed in 4.0.6, 3.5.12
- CVE-2026-46543nimiq-blockchain: Genesis batch set requestcrates.io · nimiq-blockchain · fixed in 1.5.0
- CVE-2026-41694SAML Payloads Decrypted Without Valid SignatureMaven · org.springframework.security:spring-security-saml2-service-provider · fixed in 7.0.6, 6.5.11
- CVE-2026-41008Spring Security Authorization Server Open Redirect via request_uriMaven · org.springframework.security:spring-security-oauth2-authorization-server · fixed in 7.0.6, 1.5.8
- CVE-2026-41003Unencoded HTML Outputs in Spring Security May Allow Cross-Site ScriptingMaven · org.springframework.security:spring-security-saml2-service-provider · fixed in 7.0.6, 6.5.11
- CVE-2026-40993Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database EntryMaven · org.springframework.security:spring-security-saml2-service-provider · fixed in 7.0.6
- CVE-2026-40991XML External Entity (XXE) injection when documenting untrusted XML contentMaven · org.springframework.restdocs:spring-restdocs-restassured, org.springframework.restdocs:spring-restdocs-webtestclient · fixed in 4.0.1, 3.0.6
- CVE-2026-46542nimiq-keys: Denial of service in Ed25519 multisig delinearization via invalid curve pointscrates.io · nimiq-keys · fixed in 1.4.0
- CVE-2026-40988Unbounded DEFLATE Inflation in SAML 2.0 Service ProviderMaven · org.springframework.security:spring-security-saml2-service-provider · fixed in 7.0.6, 6.5.11
- CVE-2026-46539nimiq-primitives: BlockInclusionProof interlink issue when hops are emptycrates.io · nimiq-primitives
- CVE-2026-53675BuddyPress 14.4.0 Friends List IDOR via REST APIPackagist · buddypress/buddypress
- CVE-2026-53673BuddyPress 14.4.0 Private Message IDOR via REST API user_id ParameterPackagist · buddypress/buddypress · fixed in 14.5.0
- CVE-2026-44716Pipecat: Path Traversal in Pipecat Runner `/files` Endpoint — Arbitrary File Read via `%2F`-Encoded SeparatorPyPI · pipecat-ai · fixed in 1.2.0
- CVE-2026-46517LMDeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-outPyPI · lmdeploy · fixed in 0.13.0
- CVE-2026-46432LMDeploy: Arbitrary code execution via hardcoded trust_remote_code=True in lmdeploy model initializationPyPI · lmdeploy · fixed in 0.13.0
- CVE-2026-46491SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletionPackagist · simplesamlphp/simplesamlphp-module-casserver · fixed in 7.0.3
- CVE-2026-46374SQLFluff: Uncontrolled Resource Consumption in ParserPyPI · sqlfluff · fixed in 4.2.0
- CVE-2026-46373SQLFluff: Recursive Stack Overflow in ParserPyPI · sqlfluff · fixed in 4.1.0
- CVE-2025-71319image-size 2.0.2 Denial of Service via Infinite Loop in JXL/HEIF Parsernpm · image-size · fixed in 1.2.1, 2.0.2
- CVE-2026-50636LimeSurvey RemoteControl invite_participants/remind_participants SQL InjectionPackagist · limesurvey/limesurvey
- CVE-2026-50635LimeSurvey Password Reset Host Header Injection Discloses Reset TokenPackagist · limesurvey/limesurvey
- CVE-2026-45591ASP.NET Core Denial of Service VulnerabilityNuGet · microsoft.aspnetcore.app.runtime.linux-x64, microsoft.aspnetcore.app.runtime.osx-arm64 +2 · fixed in 8.0.28, 9.0.17, 10.0.9
- CVE-2026-45491.NET Tampering VulnerabilityNuGet · microsoft.netcore.app.runtime.linux-x64, microsoft.netcore.app.runtime.osx-arm64 +1 · fixed in 8.0.28, 9.0.17, 10.0.9
- CVE-2026-42599Cross-site scripting via spread attributes in Svelte SSRnpm · svelte · fixed in 5.55.7
- CVE-2026-42567Svelte: ReDoS in `<svelte:element>` Tag Validationnpm · svelte · fixed in 5.55.7
- CVE-2026-42573Svelte: XSS via DOM Clobbering of Internal Framework Statenpm · svelte · fixed in 5.55.7