Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-48710Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checksPyPI · starlette · fixed in 1.0.1
- CVE-2026-44983smallbitvec: Safe API Triggered Heap Buffer Overflow via Integer Overflowcrates.io · smallbitvec
- CVE-2026-44213OpenTelemetry.Exporter.Instana bypasses TLS certificate validation when a proxy is configuredNuGet · opentelemetry.exporter.instana · fixed in 1.1.0
- CVE-2026-44788SharpCompress: Directory traversal via directory entries in WriteToDirectory (zip slip variant)NuGet · sharpcompress · fixed in 0.48.0
- CVE-2026-44903Prometheus: Stored XSS via crafted histogram bucket label values in the heatmap display of the old Prometheus web UIGo · github.com/prometheus/prometheus · fixed in 0.311.3
- CVE-2026-44966Velocity.js: Prototype Pollution in #set path assignmentnpm · velocityjs
- CVE-2026-44895GitLab MCP Server: SSE transport has no authentication and wildcard CORS, exposing all GitLab toolsnpm · @yoda.digital/gitlab-mcp-server · fixed in 0.6.0
- CVE-2026-44900epa4all-client: VAU Signature bypassMaven · com.oviva.telematik:epa4all-client · fixed in 1.2.1
- CVE-2026-45574epa4all-client: TLS Certificate Validation Disabled in ProductionMaven · com.oviva.telematik:epa4all-client · fixed in 1.2.2
- CVE-2026-45575epa4all-client: Improper Verification of Cryptographic SignatureMaven · com.oviva.telematik:epa4all-client · fixed in 1.2.2
- CVE-2026-47672epa4all-client: Unauthenticated REST API for Patient Record WritesMaven · com.oviva.telematik:epa4all-rest-service
- CVE-2026-44209Banks: Critical Remote Code Execution (RCE) via Jinja2 SSTIPyPI · banks · fixed in 2.4.2
- CVE-2026-44898Mistune TOC Anchor Injection XSSPyPI · mistune · fixed in 3.2.1
- CVE-2026-44897Mistune Heading ID Attribute Injection XSSPyPI · mistune · fixed in 3.2.1
- CVE-2026-44708Mistune Math Plugin XSS Escape BypassPyPI · mistune · fixed in 3.2.1
- CVE-2026-44899Mistune Image Directive CSS Injection VulnerabilityPyPI · mistune · fixed in 3.2.1
- CVE-2026-44896Mistune: XSS via unescaped figclass/figwidth in Figure directivePyPI · mistune · fixed in 3.2.1
- CVE-2026-44844eml_parser: Recursion DoS via nested message/rfc822 attachmentsPyPI · eml-parser · fixed in 3.0.1
- CVE-2026-44843LangChain: Unsafe deserialization of attacker-controlled LangChain objects through overly broad `load()` allowlistsPyPI · langchain-core · fixed in 1.3.3, 0.3.85
- CVE-2026-44836view_component: Preview Route Can Dispatch Inherited Helper MethodsRubyGems · view_component · fixed in 4.9.0
- CVE-2026-44837view_component: System Test Entry Point Path Check Allows Sibling Directory EscapeRubyGems · view_component · fixed in 4.9.0
- CVE-2026-44214eventsource-encoder: SSE event injection via unsanitized event and id fieldsnpm · eventsource-encoder · fixed in 1.0.2
- CVE-2026-44833Snipe-IT: Open redirect vulnerabilityPackagist · snipe/snipe-it · fixed in 8.4.1
- CVE-2026-44832Snipe-IT: Privilege Escalation via API Permissions AssignmentPackagist · snipe/snipe-it · fixed in 8.4.1
- CVE-2026-44831Snipe-IT: XSS vulnerability in component notesPackagist · snipe/snipe-it · fixed in 8.4.1
- CVE-2026-42448wormhole receive, with --output pointing at an existing directory can be path-traversedPyPI · magic-wormhole · fixed in 0.24.0
- CVE-2026-44728Improper Control of Generation of Code when compiling specifically crafted malicious code with @babel/plugin-transform-modules-systemjsnpm · @babel/plugin-transform-modules-systemjs · fixed in 7.29.4, 8.0.0-alpha.13
- CVE-2026-41164nuts-node: JWT type confusion in v1 access token introspection allows VP replay as access tokenGo · github.com/nuts-foundation/nuts-node
- CVE-2026-44730OpenCTI: Privilege escalation via graphQL API abusable by organization admins, due to incorrect ACL on userEdit relationAddPyPI · pycti · fixed in 6.9.7
- CVE-2026-44680MikroORM: SQL injection via runtime-controlled identifiers and JSON-path keysnpm · @mikro-orm/knex, @mikro-orm/sql · fixed in 6.6.14, 7.0.14