Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-45287OpenTelemetry-Go's Schema ParseFile leaks file descriptors on each parseGo · go.opentelemetry.io/otel/schema, go.opentelemetry.io/otel/schema/v1.0 +1 · fixed in 0.0.17
- CVE-2026-10813LMCache KV Cache utils.py hex_hash_to_int16 weak hashPyPI · lmcache
- CVE-2026-41178OpenTelemetry-Go's baggage parsing no longer caps raw header lengthGo · go.opentelemetry.io/otel, go.opentelemetry.io/otel/baggage +1 · fixed in 1.42.0, 1.44.0
- CVE-2026-10812zilliztech GPTCache Cache Key pre.py BufferedReader.peek weak hashPyPI · gptcache
- CVE-2026-47707Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias AmplificationPyPI · strawberry-graphql · fixed in 0.315.7
- CVE-2026-45739Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLsPyPI · strawberry-graphql · fixed in 0.315.4
- CVE-2026-47706Strawberry GraphQL has a Circular Fragment Reference DOSPyPI · strawberry-graphql · fixed in 0.315.7
- CVE-2026-10804Streamlit Palette hashing.py weak hashPyPI · streamlit · fixed in 1.53.1
- CVE-2026-10803MLflow Dataset Digest Computation digest_utils.py mlflow.data.digest_utils weak hashPyPI · mlflow · fixed in 3.10.1
- CVE-2026-10802keystonejs keystone GraphQL API Endpoint output-field.ts resource consumptionnpm · @keystone-6/core
- CVE-2026-10801modelscope ms-swift PIL Image Cache Key base.py Template._save_pil_image weak hashPyPI · ms-swift
- CVE-2026-41283OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed.PyPI · mistral · fixed in 20.1.1
- CVE-2026-44393An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0.PyPI · oslo-messaging
- CVE-2026-48681OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.PyPI · ironic · fixed in 26.1.7, 29.0.6, 32.0.2 and more
- CVE-2026-10783gradio-app gradio Audio Cache Key save_audio_to_cache weak hashPyPI · gradio · fixed in 6.15.1
- CVE-2026-10775sgl-project SGLang Cache data_hash denial of servicePyPI · sglang
- CVE-2026-10766mlrun DataFrame Hash helpers.py mlrun.utils.helpers.calculate_dataframe_hash weak hashPyPI · mlrun
- CVE-2026-7888Concrete CMS below 9.5.3 is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components that lack the allowed_classes restriction.Packagist · concrete5/concrete5 · fixed in 9.5.2
- CVE-2026-6657CORS Origin Validation Bypass in jupyter-serverPyPI · jupyter-server
- CVE-2022-31114backpack/crud Vulnerable to Cross-site ScriptingPackagist · backpack/crud · fixed in 5.0.13, 4.1.69, 4.0.63
- CVE-2026-44546Header injection via WebSocket upgrade parser differential allows ASGI scope header spoofingPyPI · daphne · fixed in 4.2.2
- CVE-2026-44545Unbounded WebSocket message and frame sizes can cause unauthenticated remote denial of servicePyPI · daphne · fixed in 4.2.2
- CVE-2026-48587Potential exposure of private data via whitespace padding in Vary headerPyPI · django · fixed in 5.2.15, 6.0.6
- CVE-2026-35193Potential exposure of private data via missing Vary: Authorization in UpdateCacheMiddlewarePyPI · django · fixed in 5.2.15, 6.0.6
- CVE-2026-8404Potential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddlewarePyPI · django · fixed in 5.2.15, 6.0.6
- CVE-2026-7666Potential unencrypted email transmission via STARTTLS in the SMTP backendPyPI · django · fixed in 5.2.15, 6.0.6
- CVE-2026-6873Signed cookie salt namespace collision in django.http.HttpRequest.get_signed_cookiePyPI · django · fixed in 5.2.15, 6.0.6
- CVE-2026-5241Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformersPyPI · transformers · fixed in 5.5.0
- CVE-2026-10722cilium ebpf LoadCollectionSpec/LoadCollectionSpecFromReader btf.go loadRawSpec integer overflowGo · github.com/cilium/ebpf · fixed in 0.22.0
- CVE-2026-47065Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-232Maven · org.apache.mina:mina-core · fixed in 2.2.8, 2.1.13, 2.0.29