Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-42570Svelte devalue: DoS via sparse array deserializationnpm · devalue · fixed in 5.8.1
- CVE-2026-46492md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed)npm · md-fileserver · fixed in 1.10.3
- CVE-2026-49742TYPO3 CMS - Broken Access Control in Media ModulePackagist · typo3/cms-core, typo3/cms-filelist · fixed in 11.5.51, 12.4.46, 13.4.31 and more
- CVE-2026-49741TYPO3 CMS - Privilege Escalation & SQL Injection in Form FrameworkPackagist · typo3/cms-core, typo3/cms-form · fixed in 14.3.3
- CVE-2026-49740TYPO3 CMS - Insecure Deserialization in Core APIPackagist · typo3/cms-core · fixed in 10.4.57, 11.5.51, 12.4.46 and more
- CVE-2026-49738TYPO3 CMS - Broken Access Control in File Abstraction LayerPackagist · typo3/cms-core · fixed in 10.4.57, 11.5.51, 12.4.46 and more
- CVE-2026-47352TYPO3 CMS - Broken Access Control in Backend APIPackagist · typo3/cms-backend, typo3/cms-core · fixed in 10.4.57, 11.5.51, 12.4.46 and more
- CVE-2026-47351TYPO3 CMS - Broken Access Control in ClipboardPackagist · typo3/cms-backend, typo3/cms-core · fixed in 10.4.57, 11.5.51, 12.4.46 and more
- CVE-2026-47350TYPO3 CMS - Broken Access Control in DataHandlerPackagist · typo3/cms-core · fixed in 13.4.31, 14.3.3
- CVE-2026-47349TYPO3 CMS - Broken Access Control in RecyclerPackagist · typo3/cms-core, typo3/cms-recycler · fixed in 10.4.57, 11.5.51, 12.4.46 and more
- CVE-2026-47348TYPO3 CMS - Cross-Site Scripting in Indexed SearchPackagist · typo3/cms-core, typo3/cms-indexed-search · fixed in 13.4.31, 14.3.3
- CVE-2026-47347TYPO3 CMS - Open Redirect in Core UtilitiesPackagist · typo3/cms-core · fixed in 10.4.57, 11.5.51, 12.4.46 and more
- CVE-2026-47346TYPO3 CMS - Broken Access Control in Form FrameworkPackagist · typo3/cms-core, typo3/cms-form · fixed in 10.4.57, 11.5.51, 12.4.46 and more
- CVE-2026-47343TYPO3 CMS - Destructive Actions on File Mount FoldersPackagist · typo3/cms-core · fixed in 10.4.57, 11.5.51, 12.4.46 and more
- CVE-2026-11607TYPO3 CMS - Broken Access Control in Form FrameworkPackagist · typo3/cms-core, typo3/cms-form · fixed in 10.4.57, 11.5.51, 12.4.46 and more
- CVE-2026-52902Awxkit: path traversal via yaml !include directivePyPI · awxkit
- CVE-2026-49818Apache Airflow Samba provider: Path traversal in GCSToSambaOperator via GCS object namesPyPI · apache-airflow-providers-samba · fixed in 4.12.6
- CVE-2026-34905Apache Answer: Unlisted Questions Accessible via Direct API AccessGo · github.com/apache/answer, github.com/apache/incubator-answer · fixed in 1.7.2-0.20260509071350-11c80384f13a
- CVE-2026-34033Apache Answer: HTML Content Injection in EmailGo · github.com/apache/answer, github.com/apache/incubator-answer · fixed in 1.7.2-0.20260509080709-d1a4092c61cc
- CVE-2026-34031Apache Answer: The custom avatar was not properly validatedGo · github.com/apache/answer, github.com/apache/incubator-answer · fixed in 1.7.2-0.20260511040518-11091244f64e
- CVE-2026-33582Apache Answer: Uploading specially crafted TIFF files causes an Out-of-Memory errorGo · github.com/apache/answer, github.com/apache/incubator-answer · fixed in 1.7.2-0.20260325113131-cfc3e54f30cc
- CVE-2026-25699Apache Answer: Authorization Bypass in Timeline APIGo · github.com/apache/answer, github.com/apache/incubator-answer · fixed in 1.7.2-0.20260206073245-92994b49976b
- CVE-2026-25688Apache Answer: XSS in AI Answer RenderingGo · github.com/apache/answer, github.com/apache/incubator-answer · fixed in 1.7.2-0.20260525024654-2746bf5b455f
- CVE-2026-11572Versions of the package degit before 2.8.6, from 3.0.0 and before 3.3.1 are vulnerable to Command Injection due to improper sanitisation of npm · degit · fixed in 2.8.6, 3.3.1
- CVE-2026-41007Spring HATEOAS heap exhaustion through unbounded internal cachingMaven · org.springframework.hateoas:spring-hateoas · fixed in 3.0.4, 2.5.3
- CVE-2026-41006Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configurationMaven · org.springframework.hateoas:spring-hateoas · fixed in 3.0.4, 2.5.3
- CVE-2026-41855Spring Framework Unsafe Deserialization via Jackson JMS ConvertersMaven · org.springframework:spring-jms · fixed in 6.2.19, 7.0.8
- CVE-2026-41854Spring Framework Server-Side Request Forgery via UriComponentsBuilderMaven · org.springframework:spring-web · fixed in 7.0.8, 6.2.19
- CVE-2026-41853Spring Framework Multipart Request Smuggling in Spring MVC and WebFluxMaven · org.springframework:spring-webflux, org.springframework:spring-webmvc · fixed in 7.0.8, 6.2.19
- CVE-2026-41852Spring Framework Arbitrary Method Invocation in SpEL ExpressionsMaven · org.springframework:spring-expression · fixed in 7.0.8, 6.2.19