Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-9828Logback deserialization whitelist bypass for java.lang and java.utilMaven · ch.qos.logback:logback-core · fixed in 1.5.33
- CVE-2026-40914Apache Artemis Stomp Protocol, Apache ActiveMQ Artemis Stomp Protocol: Address routing-type can be updated by STOMP protocol user without the createAddress permissionMaven · org.apache.artemis:artemis-stomp-protocol · fixed in 2.54.0
- CVE-2025-48977Apache Ignite: REST HTTP arbitrary file read vulnerabilityMaven · org.apache.ignite:ignite-core · fixed in 2.18.0
- CVE-2026-9804Kubevirt: kubevirt: vmexport directory symlink escape enables exporter pod file readGo · kubevirt.io/kubevirt
- CVE-2026-9673Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which canpm · json-2-csv · fixed in 5.5.11
- CVE-2026-9802Keycloak: keycloak: unauthorized account access via replayed refresh tokens after cluster restartMaven · org.keycloak:keycloak-services · fixed in 26.6.3
- CVE-2026-9803Keycloak: keycloak: denial of service via malformed authorization headerMaven · org.keycloak:keycloak-services · fixed in 26.6.3
- CVE-2026-9801Keycloak: keycloak: denial of service via malformed ldap password policy responseMaven · org.keycloak:keycloak-ldap-federation · fixed in 26.6.3
- CVE-2026-9798Keycloak: keycloak: brute-force protection bypass in ciba flowMaven · org.keycloak:keycloak-services
- CVE-2026-9796Keycloak: keycloak: privilege escalation via time-of-check to time-of-use (toctou) vulnerabilityMaven · org.keycloak:keycloak-server · fixed in 26.6.4
- CVE-2026-9795Keycloak: keycloak: privilege escalation via improper scope mapping enforcementMaven · org.keycloak:keycloak-services · fixed in 26.6.4
- CVE-2026-9794Keycloak: keycloak: information disclosure via saml ecp endpointMaven · org.keycloak:keycloak-services · fixed in 26.6.3
- CVE-2026-9792Keycloak: keycloak: security restriction bypass allows unauthorized ropc token acquisitionMaven · org.keycloak:keycloak-services · fixed in 26.6.3
- CVE-2026-9793Keycloak: keycloak: security policy bypass in jwe-encrypted request object processingMaven · org.keycloak:keycloak-services
- CVE-2026-9791Keycloak-rhel9: organization data leak after feature disabled in keycloakMaven · org.keycloak:keycloak-server-spi-private, org.keycloak:keycloak-services · fixed in 26.6.3
- CVE-2026-42998An issue was discovered in OpenStack Keystone before 29.0.2.PyPI · keystone · fixed in 27.0.2, 28.0.2, 29.0.2
- CVE-2026-42999An issue was discovered in OpenStack Keystone before 29.0.2.PyPI · keystone · fixed in 27.0.2, 28.0.2, 29.0.2
- CVE-2026-43000An issue was discovered in OpenStack Keystone before 29.0.2.PyPI · keystone · fixed in 27.0.2, 28.0.2, 29.0.2
- CVE-2026-44394An issue was discovered in OpenStack Keystone before 29.0.2.PyPI · keystone · fixed in 27.0.2, 28.0.2, 29.0.2
- CVE-2026-9739Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790).Go · github.com/googleapis/mcp-toolbox · fixed in 1.2.0
- CVE-2026-45152uniget: Command Injection in tool.Check Leading to Arbitrary Code ExecutionGo · gitlab.com/uniget-org/cli · fixed in 0.27.1
- CVE-2026-44720OpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account Takeovernpm · openlearnx · fixed in 2.0.4
- CVE-2026-45083Goobi viewer: Unauthenticated Solr Streaming Expression ProxyMaven · io.goobi.viewer:viewer-core
- CVE-2026-44247Volcano: Webhook server vulnerable to OOM due to unbounded HTTP request body sizeGo · volcano.sh/volcano · fixed in 1.12.4, 1.13.3, 1.14.2
- CVE-2026-45137Anchor: Program<'info, System> is not properly validatedcrates.io · anchor-lang · fixed in 1.0.2
- CVE-2026-45136claude-code-cache-fix: Local code execution via Python triple-quote injection in tools/quota-statusline.shnpm · claude-code-cache-fix · fixed in 3.5.2
- CVE-2026-44660UltraJSON: Memory Leak in ujson.dump() on Write FailurePyPI · ujson · fixed in 5.12.1
- CVE-2026-45134LangSmith Client SDK: Public prompt pull deserializes untrusted manifests without trust boundary warningnpm · langsmith · fixed in 0.6.0
- CVE-2026-44724systeminformation: Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile namenpm · systeminformation · fixed in 5.31.6
- CVE-2026-44681Authlib: Open Redirect in Authlib OIDC Implicit/Hybrid AuthorizationPyPI · authlib · fixed in 1.7.1, 1.6.12