Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-41851Spring Framework Denial of Service via Unbounded Cache in SpELMaven · org.springframework:spring-expression · fixed in 7.0.8, 6.2.19
- CVE-2026-41850Spring Framework Algorithmic Denial of Service via SpEL ExpressionsMaven · org.springframework:spring-expression · fixed in 7.0.8, 6.2.19
- CVE-2026-41849Spring Framework Denial of Service via Integer Overflow in SpEL ExpressionsMaven · org.springframework:spring-expression
- CVE-2026-41848Spring Framework Denial of Service via AntPathMatcherMaven · org.springframework:spring-core · fixed in 7.0.8, 6.2.19
- CVE-2026-41847Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSLMaven · org.springframework:spring-webflux
- CVE-2026-41846Spring Framework Cross-site Scripting via JSP Form TagsMaven · org.springframework:spring-webmvc · fixed in 7.0.8, 6.2.19
- CVE-2026-41845Spring Framework Cross-site Scripting via JavaScriptUtilsMaven · org.springframework:spring-webmvc · fixed in 7.0.8, 6.2.19
- CVE-2026-41844Spring Framework Open Redirect in Spring MVC and WebFluxMaven · org.springframework:spring-webflux, org.springframework:spring-webmvc · fixed in 7.0.8, 6.2.19
- CVE-2026-41843Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFluxMaven · org.springframework:spring-webflux, org.springframework:spring-webmvc · fixed in 7.0.8, 6.2.19
- CVE-2026-41842Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFluxMaven · org.springframework:spring-webflux, org.springframework:spring-webmvc · fixed in 7.0.8, 6.2.19
- CVE-2026-41841Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFluxMaven · org.springframework:spring-webflux, org.springframework:spring-webmvc · fixed in 7.0.8, 6.2.19
- CVE-2026-41840Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests.Maven · org.springframework:spring-webflux · fixed in 7.0.8, 6.2.19
- CVE-2026-41839Spring Framework Escalation via Session Fixation in WebFluxMaven · org.springframework:spring-webflux · fixed in 7.0.8, 6.2.19
- CVE-2026-41838Spring Framework Predictable Session ID in WebSocket ModuleMaven · org.springframework:spring-websocket · fixed in 7.0.8, 6.2.19
- CVE-2026-41720Authentication Bypass with Empty Password in Spring LDAPMaven · org.springframework.ldap:spring-ldap-core · fixed in 4.0.4, 3.3.8
- CVE-2026-41715Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade RedirectMaven · io.projectreactor.netty:reactor-netty · fixed in 1.3.6, 1.2.18
- CVE-2026-41710Cache Exhaustion in Stateful Retries leads to Denial of ServiceMaven · org.springframework.retry:spring-retry · fixed in 2.0.13
- CVE-2026-40984Micrometer HTTP server instrumentations DoS vulnerabilityMaven · io.micrometer:micrometer-core, io.micrometer:micrometer-jetty11 +1 · fixed in 1.16.6, 1.15.12
- CVE-2026-40983Micrometer gRPC server instrumentation DoS vulnerabilityMaven · io.micrometer:micrometer-core · fixed in 1.16.6, 1.15.12
- CVE-2026-44541Fides: DOM-based XSS vulnerability in fides.js via fides_description overridePyPI · ethyca-fides · fixed in 2.84.5
- CVE-2026-47345TYPO3 HTML Sanitizer allows Cross-Site ScriptingPackagist · typo3/html-sanitizer · fixed in 2.3.2
- CVE-2026-47344TYPO3 HTML Sanitizer allows Cross-Site ScriptingPackagist · typo3/html-sanitizer · fixed in 2.3.2
- CVE-2026-46490samlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML Assertionsnpm · samlify · fixed in 2.13.0
- CVE-2026-11393Code injection via improper triple-quote escaping in AgentCore CLI Bedrock Agent importnpm · @aws/agentcore · fixed in 0.14.2, 1.0.0-preview.9
- CVE-2026-46486Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processingPyPI · mvt · fixed in 2026.5.12
- CVE-2026-52778YesWiki has Unsafe eval() in Formula Calculator - Remote Code Execution (RCE) & Denial of Service (DoS)Packagist · yeswiki/yeswiki · fixed in 4.6.6
- CVE-2026-45581fabric-chaincode-java: TLS Private Key Password Disclosed in INFO Startup Logs in Chaincode-as-a-Service ModeMaven · org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim · fixed in 2.5.10
- CVE-2026-46481OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular usersMaven · org.open-metadata:openmetadata-service · fixed in 1.12.4
- CVE-2026-43966HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2Hex · cowboy, cowlib +1 · fixed in 2.16.0, 2.22.0
- CVE-2026-48507Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing usersPackagist · snipe/snipe-it · fixed in 8.6.0