Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-45078Synapse CPU starvation (Denial of Service)PyPI · matrix-synapse · fixed in 1.152.1
- CVE-2026-45076Synapse pagination denial of servicePyPI · matrix-synapse · fixed in 1.152.1
- CVE-2026-41185ServiceAccount token disclosure via Azure IPAM CNI plugin logsGo · github.com/projectcalico/calico, github.com/projectcalico/calico/v3 · fixed in 3.31.6, 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f
- CVE-2026-6720Calicoctl leaks cluster credentials to stderr when verbose logging is enabledGo · github.com/projectcalico/calicoctl, github.com/projectcalico/calicoctl/v3 · fixed in 3.31.6
- CVE-2026-41184ServiceAccount token disclosure via install-cni container logsGo · github.com/projectcalico/calico, github.com/projectcalico/calico/v3 · fixed in 3.31.6, 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f
- CVE-2026-44477CloudNativePG: Metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCEGo · github.com/cloudnative-pg/cloudnative-pg · fixed in 1.28.3, 1.29.1
- CVE-2026-47673Hono: JWT middleware accepts any Authorization scheme, not only Bearernpm · hono · fixed in 4.12.21
- CVE-2026-47674Hono: IP Restriction bypasses static deny rules for non-canonical IPv6npm · hono · fixed in 4.12.21
- CVE-2026-47675Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injectionnpm · hono · fixed in 4.12.21
- CVE-2026-47676Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded pathsnpm · hono · fixed in 4.12.21
- CVE-2026-47762TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` commentsnpm · tinymce · fixed in 7.9.3, 8.5.1
- CVE-2026-47761TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injectionnpm · tinymce · fixed in 7.9.3, 8.5.1
- CVE-2026-47759TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributesnpm · tinymce · fixed in 7.9.3, 8.5.1
- CVE-2026-47760TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGsnpm · tinymce · fixed in 7.1.0
- CVE-2026-48525PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWSPyPI · pyjwt · fixed in 2.13.0
- CVE-2026-48523PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keysPyPI · pyjwt · fixed in 2.12.1, 2.13.0
- CVE-2026-48526PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowedPyPI · pyjwt · fixed in 2.13.0
- CVE-2026-48524PyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)PyPI · pyjwt · fixed in 2.13.0
- CVE-2026-48522PyJWKClient: missing scheme allowlist enables SSRF + token forgery via file://, ftp://, data: schemesPyPI · pyjwt · fixed in 2.13.0
- CVE-2026-48155pypdf: Possible large memory usage for large offsets for layout mode textPyPI · pypdf · fixed in 6.12.0
- CVE-2026-48156pypdf: Possible long runtimes for zero-only width values in cross-reference streamsPyPI · pypdf · fixed in 6.12.0
- CVE-2026-48735pypdf: Manipulated XMP metadata streams can exhaust RAMPyPI · pypdf · fixed in 6.12.1
- CVE-2026-44594esm.sh: Path Traversal via package.json browser field allows reading arbitrary server filesGo · github.com/esm-dev/esm.sh · fixed in 0.0.0-20250616164159-0593516c4cfa
- CVE-2026-44593esm.sh: Legacy Route Path Traversal Can Lead to RCEGo · github.com/esm-dev/esm.sh · fixed in 0.0.0-20260508100112-1960055e1d53
- CVE-2026-44672mapfish-print: Remote Code Injection (RCE) in Dynamic tableMaven · org.mapfish.print:print-lib, org.mapfish.print:print-servlet · fixed in 3.28.28, 3.30.30, 3.31.21 and more
- CVE-2026-45017Python Liquid: Absolute paths escape filesystem loader search pathPyPI · python-liquid · fixed in 2.2.0
- CVE-2026-35676phpMyFAQ - Unauthenticated Password Reset via User Password Update EndpointPackagist · phpmyfaq/phpmyfaq, thorsten/phpmyfaq · fixed in 4.1.3
- CVE-2026-35675phpMyFAQ - Authentication Bypass via Missing Password Reset Token in /api/user/password/updatePackagist · phpmyfaq/phpmyfaq, thorsten/phpmyfaq · fixed in 4.1.3
- CVE-2026-35672phpMyFAQ - Authentication Bypass via Empty API TokenPackagist · phpmyfaq/phpmyfaq, thorsten/phpmyfaq · fixed in 4.1.3
- CVE-2026-35671phpMyFAQ - Insecure Direct Object Reference in User Password APIPackagist · phpmyfaq/phpmyfaq, thorsten/phpmyfaq · fixed in 4.1.3