Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-46357HAX CMS NodeJS application Vulnerable to Denial of Service using Malicious Import Requestnpm · @haxtheweb/haxcms-nodejs · fixed in 26.0.0
- CVE-2026-11401Privilege Escalation in AWS Advanced Go Wrapper for Amazon Aurora PostgreSQLGo · github.com/aws/aws-advanced-go-wrapper/auth-helpers, github.com/aws/aws-advanced-go-wrapper/aws-secrets-manager +10 · fixed in 1.1.1, 1.1.2, 2.0.1 and more
- CVE-2026-11400Privilege Escalation in AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQLMaven · software.amazon.jdbc:aws-advanced-jdbc-wrapper · fixed in 4.0.1
- CVE-2026-46496HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theftnpm · @haxtheweb/haxcms-nodejs, @haxtheweb/video-player · fixed in 26.0.0
- CVE-2026-46396HAX CMS has a stored XSS via <iframe> that allows access to sensitive client-side data and account takeovernpm · @haxtheweb/haxcms-nodejs, @haxtheweb/iframe-loader +1 · fixed in 26.0.0
- CVE-2026-46511HAXcms: Mass Token Exfiltration and Cross-Tenant Hijacknpm · @haxtheweb/haxcms-nodejs · fixed in 26.0.0
- CVE-2026-46395HAX CMS Vulnerable to Private Key Disclosure via Broken HMAC Implementationnpm · @haxtheweb/haxcms-nodejs · fixed in 26.0.0
- CVE-2026-46393HAXcms createSite SSRF Enables Arbitrary File Readnpm · @haxtheweb/haxcms-nodejs · fixed in 26.0.0
- CVE-2026-46391HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apisnpm · @haxtheweb/open-apis · fixed in 26.0.0
- CVE-2026-45327TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injectionGo · github.com/datanoisetv/tinyice · fixed in 2.5.0
- CVE-2026-11330thedotmack claude-mem Observation Content Hash store.ts computeObservationContentHash weak hashnpm · claude-mem · fixed in 12.0.0
- CVE-2026-11332Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code executionPyPI · ansible-core · fixed in 2.16.19rc1, 2.18.18rc1, 2.19.11rc1 and more
- CVE-2026-9088Keycloak: keycloak: information disclosure due to user profile permission bypassMaven · org.keycloak:keycloak-services · fixed in 26.7.0
- CVE-2026-10732All versions of the package decompress are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) when extracting a ZIP archivnpm · decompress
- CVE-2026-41567Docker: `PUT /containers/{id}/archive` executes container binary on the hostGo · github.com/docker/docker, github.com/moby/moby +1 · fixed in 2.0.0-beta.14
- CVE-2026-11312bytedance InfiniStore KV Map infinistore.h purge_kv_map algorithmic complexityPyPI · infinistore
- CVE-2026-37737sanic-cors version 2.2.0 and prior contains an improper regular expression in the try_match() function in sanic_cors/core.py that uses re.maPyPI · sanic-cors
- CVE-2026-50589In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or JPyPI · ironic · fixed in 37.0.0
- CVE-2026-41249CoreShop Vulnerable to Remote Code Execution (RCE) via Insecure `pull_request_target` ConfigurationPackagist · coreshop/core-shop
- CVE-2026-41237Froxlor has an incomplete fix for CVE-2026-30932Packagist · froxlor/froxlor · fixed in 2.3.7
- CVE-2026-41236Froxlor has privilege escalation in SSH key synchronization via symlinked `authorized_keys` pathPackagist · froxlor/froxlor · fixed in 2.3.7
- CVE-2026-41235Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcementPackagist · froxlor/froxlor · fixed in 2.3.7
- CVE-2026-41234Froxlor: BIND Zone File Injection via TXT Record ContentPackagist · froxlor/froxlor · fixed in 2.3.7
- CVE-2026-40898quic-go: HTTP/3 QPACK Trailer Expansion Memory ExhaustionGo · github.com/quic-go/quic-go · fixed in 0.59.1
- CVE-2026-48480netty-incubator-codec-ohttp OHttpVersionChunkDraft's Missing Final-Chunk Enforcement Leads to Undetected Stream TruncationMaven · io.netty.incubator:netty-incubator-codec-ohttp · fixed in 0.0.22.Final
- CVE-2026-48040netty-incubator-codec-ohttp's Incorrect Native Pointer Derivation in Pooled Direct ByteBuf Fallback Leads to Out-of-Bounds Native Memory AccessMaven · io.netty.incubator:netty-incubator-codec-ohttp-hpke-native-boringssl · fixed in 0.0.22.Final
- CVE-2026-41207netty-incubator-codec-ohttp's HPKEContext operations may produce empty byte[] on failuresMaven · io.netty.incubator:netty-incubator-codec-ohttp · fixed in 0.0.21.Final
- CVE-2026-50266In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set devicPyPI · neutron · fixed in 28.0.1
- CVE-2026-50076Apache Fory: Java ReplaceResolverSerializer deserialization checks bypassMaven · org.apache.fory:fory-core · fixed in 1.1.0
- CVE-2026-10814milvus-io milvus Grantee ID Hash kv_catalog.go weak hashGo · github.com/milvus-io/milvus · fixed in 0.10.3-0.20260602041816-3d932f1c3e06