Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-4035Environment Variable Resolution Vulnerability in mlflow/mlflowPyPI · mlflow · fixed in 3.11.0
- CVE-2026-5078morgan vulnerable to Log Forging via unneutralized control characters in :remote-usernpm · morgan · fixed in 1.11.0
- CVE-2026-37462An integer underflow in the BGPUpdate.DecodeFromBytes function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (Go · github.com/osrg/gobgp/v4 · fixed in 4.4.0
- CVE-2026-46447OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_infoPyPI · ironic · fixed in 26.1.7, 29.0.6, 32.0.2 and more
- CVE-2026-10692johnhuang316 code-index-mcp search_code_advanced is_safe_regex_pattern redosPyPI · code-index-mcp · fixed in 2.14.1
- CVE-2026-10691wonderwhy-er DesktopCommanderMCP start_search search-manager.ts redosnpm · @wonderwhy-er/desktop-commander · fixed in 0.2.39
- CVE-2026-10690wonderwhy-er DesktopCommanderMCP read_file filesystem.ts readFileFromUrl server-side request forgerynpm · @wonderwhy-er/desktop-commander
- CVE-2026-42507Arbitrary inputs are included in errors without any escaping in net/textprotoGo · stdlib · fixed in 1.25.11, 1.26.4
- CVE-2026-42504Quadratic complexity in WordDecoder.DecodeHeader in mimeGo · mime · fixed in 1.25.11, 1.26.4
- CVE-2026-27145Inefficient candidate hostname parsing in crypto/x509Go · stdlib · fixed in 1.25.11, 1.26.4
- CVE-2026-35212OpenCTI has XSS in the rendering of email-message observable body dataPyPI · pycti · fixed in 7.260227.0
- CVE-2026-49144BrowserStack Runner 0.9.5 Path Traversal via _default HTTP Handlernpm · browserstack-runner
- CVE-2026-49143BrowserStack Runner 0.9.5 Unauthenticated RCE via /_log HTTP Handlernpm · browserstack-runner
- CVE-2026-47201authentik: XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated userGo · goauthentik.io · fixed in 0.0.0-20260528144335-a370d76d23c7
- CVE-2026-48596CRLF injection in Tesla.Multipart.add_content_type_param/2 allows HTTP header injectionHex · tesla · fixed in 1.18.3
- CVE-2026-48594Decompression bomb in Tesla.Middleware.DecompressResponse and Tesla.Middleware.CompressionHex · tesla · fixed in 1.18.3
- CVE-2026-48595Authorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirectsHex · tesla · fixed in 1.18.3
- CVE-2026-48597Atom table exhaustion via untrusted URL scheme in Tesla.Adapter.MintHex · tesla · fixed in 1.18.3
- CVE-2026-48598CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injectionHex · tesla · fixed in 1.18.3
- CVE-2026-35202Pterodactyl has a database resource limit bypass via race condition in Client APIPackagist · pterodactyl/panel · fixed in 1.12.3
- CVE-2026-47265AIOHTTP vulnerable to cross-origin redirect with per-request cookiesPyPI · aiohttp · fixed in 3.14.0
- CVE-2026-34993AIOHTTP Vulnerable to Deserialization of Untrusted DataPyPI · aiohttp · fixed in 3.14.0
- CVE-2026-42342React Router vulnerable to DoS via unbounded path expansion in __manifest endpointnpm · @remix-run/server-runtime, react-router · fixed in 2.17.5, 7.15.0
- CVE-2026-42211React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCEnpm · react-router · fixed in 7.14.2
- CVE-2026-40181React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretationnpm · @remix-run/router, react-router · fixed in 1.23.3, 7.14.1, 6.30.4
- CVE-2026-34077React Router vulnerable to Denial of Service via reflected user input in single-fetchnpm · react-router, turbo-stream · fixed in 7.14.0, 3.0.0
- CVE-2026-33245React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targetsnpm · react-router · fixed in 7.13.2
- CVE-2026-33244React Router has stored XSS via unescaped Location header in prerendered redirect HTMLnpm · react-router · fixed in 7.13.2
- CVE-2026-42073OpenClaude's MCP OAuth Callback: State Check Bypass via error Param Leads to DoSnpm · @gitlawb/openclaude · fixed in 0.5.1
- CVE-2026-42074OpenClaude: Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` Inputnpm · openclaude · fixed in 0.5.1