Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-45554NiceGUI: Unauthenticated log-flood DoS via trailing slash on ESM and per-component resource routesPyPI · nicegui · fixed in 3.12.0
- CVE-2026-45553NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text()PyPI · nicegui · fixed in 3.12.0
- CVE-2026-45686OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBIGo · go.opentelemetry.io/obi · fixed in 0.9.0
- CVE-2026-45685OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messagesGo · go.opentelemetry.io/obi · fixed in 0.9.0
- CVE-2026-45684OpenTelemetry eBPF Instrumentation: Log enricher writev path can overread and overwrite user buffersGo · go.opentelemetry.io/obi · fixed in 0.9.0
- CVE-2026-45683OpenTelemetry eBPF Instrumentation: Java TLS ioctl kprobe allows kernel memory disclosureGo · go.opentelemetry.io/obi · fixed in 0.9.0
- CVE-2026-45681OpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB sizeGo · go.opentelemetry.io/obi · fixed in 0.9.0
- CVE-2026-45680OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPUGo · go.opentelemetry.io/obi · fixed in 0.9.0
- CVE-2026-45679OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messagesGo · go.opentelemetry.io/obi · fixed in 0.9.0
- CVE-2026-45678OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloadsGo · go.opentelemetry.io/obi · fixed in 0.9.0
- CVE-2026-45676OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agentGo · go.opentelemetry.io/obi · fixed in 0.9.0
- CVE-2026-45682OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removalsGo · go.opentelemetry.io/obi · fixed in 0.9.0
- CVE-2026-47117OpenMed < 1.5.2 Remote Code Execution via PII Model LoadingPyPI · openmed · fixed in 1.5.2
- CVE-2026-46718Apache Calcite: A user-controled model can load arbitrary classes, leading to code executionMaven · org.apache.calcite:calcite-core · fixed in 1.42.0
- CVE-2026-5422Path Traversal in jupyter/jupyterPyPI · jupyter-server · fixed in 2.18.2
- CVE-2026-3514Authentication Bypass in prefecthq/prefectPyPI · prefect · fixed in 3.6.22.dev7, 3.6.22
- CVE-2026-3198Improper Access Control in mlflow/mlflowPyPI · mlflow · fixed in 3.11.0rc0
- CVE-2026-10566FoundationAgents MetaGPT schema.py Message.check_instruct_content deserializationPyPI · metagpt
- CVE-2026-10300SGLang Inference HTTP Endpoint lora_manager.py assertionPyPI · sglang
- CVE-2026-25879Langroid has Prompt to SQL Injection, Leading to RCEPyPI · langroid · fixed in 0.63.0
- CVE-2026-10291Enderfga claw-orchestrator Session Grep Endpoint embedded-server.ts validateRegex redosnpm · @enderfga/claw-orchestrator · fixed in 3.7.1
- CVE-2026-49138Nanobot < 0.2.1 SSRF via web_fetch Tool Redirect FollowingPyPI · nanobot-ai · fixed in 0.2.1
- CVE-2026-10281Enderfga claw-orchestrator API Endpoint embedded-server.ts EmbeddedServer missing authenticationnpm · @enderfga/claw-orchestrator · fixed in 3.5.6
- CVE-2026-30963Capsule Namespace Hijacking via subresourceGo · github.com/projectcapsule/capsule · fixed in 0.13.0
- CVE-2026-40990Unbounded cache for function definitionsMaven · org.springframework.cloud:spring-cloud-function-context · fixed in 4.3.3, 5.0.2
- CVE-2026-40989Self Routing guard bypassed via function compositionMaven · org.springframework.cloud:spring-cloud-function-context · fixed in 4.3.3, 5.0.2
- CVE-2026-22872Capsule TenantResource RawItems Cluster-Scoped Resource Creation VulnerabilityGo · github.com/projectcapsule/capsule · fixed in 0.13.0
- CVE-2026-45727CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloakserve leads to arbitrary directory deletionPyPI · cloakbrowser · fixed in 0.3.28
- CVE-2026-45302Prototype Pollution in parse-nested-form-data via `__proto__` in FormData field namesnpm · parse-nested-form-data · fixed in 1.0.1
- CVE-2024-52011launch-editor vulnerable to command injection via the crafted request on Windowsnpm · launch-editor, vite · fixed in 2.9.0, 5.4.9