Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-45047bird-lg-go: Fatal Out-of-Memory (OOM) Denial of Service via Unbounded JSON DecodingGo · github.com/xddxdd/bird-lg-go · fixed in 0.0.0-20260507060110-0ff87024cb9e
- CVE-2026-42328go-ipld-prime: DAG-CBOR and DAG-JSON decoders unbounded recursion depthGo · github.com/ipld/go-ipld-prime · fixed in 0.23.0
- CVE-2026-42081free5GC: UE Security Capability bypass on NGAP PathSwitchRequestGo · github.com/free5gc/amf
- CVE-2026-42082free5GC: Missing Concurrent NAS SMC Validation During NGAP HandoverGo · github.com/free5gc/amf
- CVE-2026-42083free5GC: PCF Npcf_SMPolicyControl missing authentication middleware allows unauthenticated access to SM policy handlers and disclosure of subscriber SUPIGo · github.com/free5gc/pcf · fixed in 1.4.3
- CVE-2026-42459free5GC: Improper Input Validation and Generation of Error Message Containing Sensitive Information in github.com/free5gc/udmGo · github.com/free5gc/udm
- CVE-2026-44315free5GC: NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactionsGo · github.com/free5gc/nef
- CVE-2026-44316free5GC: PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereferenceGo · github.com/free5gc/pcf · fixed in 1.4.2
- CVE-2026-44317free5GC: PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing AfRoutReq via nil pointer dereferenceGo · github.com/free5gc/pcf · fixed in 1.4.3
- CVE-2026-44319free5GC: NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri)Go · github.com/free5gc/nef · fixed in 1.2.3
- CVE-2026-44320free5GC: NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing pathGo · github.com/free5gc/nef
- CVE-2026-44321free5GC: SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf)Go · github.com/free5gc/smf
- CVE-2026-44322free5GC: NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereferenceGo · github.com/free5gc/nef · fixed in 1.2.3
- CVE-2026-44323free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exists (nil pointer dereference)Go · github.com/free5gc/udr · fixed in 1.4.3
- CVE-2026-44324free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface type assertion (single authenticated request)Go · github.com/free5gc/udr · fixed in 1.4.3
- CVE-2026-44325free5GC: NRF POST /oauth2/token structured-form parser type-confusion panic family (Reflect.Set on incompatible types)Go · github.com/free5gc/nrf · fixed in 1.4.3
- CVE-2026-44326free5GC: NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptionsGo · github.com/free5gc/nef
- CVE-2026-44327free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handlerGo · github.com/free5gc/nef
- CVE-2026-44328free5GC: SMF UPI DELETE /upi/v1/upNodesLinks/{ref} panics on AN-node deletion via nil UPF dereference; unauthenticated, state-mutatingGo · github.com/free5gc/smf · fixed in 1.4.3
- CVE-2026-44329free5GC: SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlersGo · github.com/free5gc/smf · fixed in 1.4.3
- CVE-2026-44330free5GC: NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptionsGo · github.com/free5gc/nef
- CVE-2026-44318free5GC: BSF concurrent PUT /nbsf-management/v1/subscriptions/{subId} crashes the BSF process via concurrent map read/write on SubscriptionsGo · github.com/free5gc/bsf · fixed in 1.0.2
- CVE-2026-44483RVF: Prototype pollution in @rvf/set-get reachable via @rvf/core preprocessFormData (HTTP form data)npm · @rvf/set-get · fixed in 7.0.2, 6.0.4
- CVE-2026-44473Ella Core: UE Downlink Redirection via Forged PDUSessionResourceSetupResponseGo · github.com/ellanetworks/core · fixed in 1.10.0
- CVE-2026-44475Ella Core: UE Security Capability bypass on NGAP PathSwitchRequestGo · github.com/ellanetworks/core · fixed in 1.10.0
- CVE-2026-44474Ella Core: Handover failures during concurrent Security Mode CommandGo · github.com/ellanetworks/core · fixed in 1.10.0
- CVE-2026-44353Streamlink: Arbitrary local file read via file:// URI in HLS and DASHPyPI · streamlink · fixed in 8.4.0
- CVE-2026-48545Gradio < 6.15.0 Cookie Injection via Shared Proxy ClientPyPI · gradio · fixed in 6.15.0
- CVE-2026-45570go-git: Improper single-quote escaping in go-git SSH transportGo · github.com/go-git/go-git, github.com/go-git/go-git/v5 +1 · fixed in 5.19.1, 6.0.0-alpha.4
- CVE-2026-45571go-git: Crafted repositories may modify main and submodule .git directoriesGo · github.com/go-git/go-git, github.com/go-git/go-git/v5 +1 · fixed in 5.19.1, 6.0.0-alpha.4