Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-45022go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream GitGo · github.com/go-git/go-git/v5, github.com/go-git/go-git/v6 · fixed in 5.19.0, 6.0.0-alpha.3
- CVE-2026-44902opentelemetry-js: Prometheus exporter process crash via malformed HTTP requestnpm · @opentelemetry/auto-instrumentations-node, @opentelemetry/exporter-prometheus +1 · fixed in 0.75.0, 0.217.0
- CVE-2026-44971GuardDog: Blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltrationPyPI · guarddog
- CVE-2026-44972GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package contentPyPI · guarddog
- CVE-2026-42280Improper Permission Checking in Auth.js SDKnpm · auth0-js · fixed in 10.0.0
- CVE-2026-48544Taipy 4.1.1 Path Traversal via ElementLibrary.get_resource()PyPI · taipy
- CVE-2026-9712Insecure direct object referencePyPI · pretix · fixed in 2026.4.2
- CVE-2026-42184Tauri: Origin Confusion Allows Remote Pages to Invoke Local-Only IPC Commandscrates.io · tauri · fixed in 2.11.1
- CVE-2026-9674A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 662.vd2e0001f6b_b_d and earlier allows attackers to resume failMaven · org.jenkins-ci.plugins:jenkins-multijob-plugin · fixed in 669.v9d96a
- CVE-2026-48927Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the build URL, resulting in a stored cross-site scripting (XSS) vulnerabilityMaven · org.jenkins-ci.plugins:buildgraph-view
- CVE-2026-48926Jenkins Job Import Plugin 143.v044a_2e819b_27 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with OMaven · org.jenkins-ci.plugins:job-import-plugin · fixed in 143.145.v48f9a
- CVE-2026-48925A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Integration Plugin 0.7.3 and earlier allows attackers to attackers to trMaven · org.jenkins-ci.plugins:github-integration-parent · fixed in 0.7.4
- CVE-2026-48924Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacMaven · org.jenkins-ci.plugins:bitbucket-oauth · fixed in 0.18
- CVE-2026-48923Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackersMaven · com.rapid7:jenkinsci-appspider-plugin · fixed in 1.0.18
- CVE-2026-48922Jenkins Credentials Binding Plugin 720.v3f6decef43ea_ and earlier does not properly sanitize file names for file and zip file credentials, aMaven · org.jenkins-ci.plugins:credentials-binding · fixed in 725.ve52b
- CVE-2026-48921Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing aMaven · io.jenkins.plugins:pipeline-groovy-lib · fixed in 798.v5cc688825312
- CVE-2026-48920Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email content by setting the `data-inlinMaven · org.jenkins-ci.plugins:email-ext · fixed in 1933.1935.v276319e3cc47
- CVE-2026-48919Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation.Maven · org.jenkins-ci.plugins:active-directory · fixed in 2.41.1
- CVE-2026-48918Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default.Maven · org.jenkins-ci.plugins:active-directory · fixed in 2.41.1
- CVE-2026-48917Jenkins LDAP Plugin 807.v7d7de30930cf and earlier deserializes data from LDAP referrals without validation.Maven · org.jenkins-ci.plugins:ldap · fixed in 807.809.vd3a
- CVE-2026-48916Jenkins LDAP Plugin 807.v7d7de30930cf and earlier follows LDAP referrals.Maven · org.jenkins-ci.plugins:ldap · fixed in 807.809.vd3a
- CVE-2026-23679libusb < 1.0.30 NULL Pointer Dereference in parse_interface()PyPI · libusb · fixed in 1.0.30
- CVE-2026-47104libusb < 1.0.30 Out-of-Bounds Read in parse_iad_array()PyPI · libusb · fixed in 1.0.30
- CVE-2026-9704Keycloak: keycloak: privilege escalation due to oversized subject_token jwtMaven · org.keycloak:keycloak-server-spi-private, org.keycloak:keycloak-services · fixed in 26.6.3
- CVE-2026-9689Keycloak: org.keycloak.protocol.oidc: http parameter pollution in oidc redirect uri allows response parameter duplication - #ghi-604Maven · org.keycloak:keycloak-services
- CVE-2026-49017In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request boPyPI · swift
- CVE-2026-49014In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow.PyPI · gdal · fixed in 3.13.1
- CVE-2026-36045picoclaw <=v0.1.2 and earlier is vulnerable to OS command injection via the ExecTool component (pkg/tools/shell.go).Go · github.com/sipeed/picoclaw
- CVE-2026-45298Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)Go · github.com/amir20/dozzle
- CVE-2026-44985Dozzle: Cross-Site WebSocket Hijacking (CSWSH) on exec/attach endpoints bypasses authenticationGo · github.com/amir20/dozzle