Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-42502Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/htmlGo · golang.org/x/net · fixed in 0.55.0
- CVE-2026-39821Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idnaGo · golang.org/x/net, stdlib · fixed in 0.55.0, 1.25.13, 1.26.6 and more
- CVE-2026-42506Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/htmlGo · golang.org/x/net · fixed in 0.55.0
- CVE-2026-8353Concrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XSS via page name in atomik themePackagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-8347Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in Express association Reorder dialogPackagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-8340Concrete CMS 9.5.0 and below is vulnerable to CSRF via Backend\File::approveVersionPackagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-9277shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`npm · shell-quote · fixed in 1.8.4
- CVE-2026-44417Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)Maven · org.apache.cxf:cxf-rt-transports-jms · fixed in 4.2.1, 4.1.6, 3.6.11
- CVE-2026-44618Apache CXF: XXE vulnerability in WS-Transfer functionalityMaven · org.apache.cxf:cxf-rt-ws-transfer · fixed in 4.2.1, 4.1.6, 3.6.11
- CVE-2026-44930Apache CXF: LDAP Injection vulnerability in XKMS LDAP RepositoryMaven · org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap · fixed in 4.2.1, 4.1.6, 3.6.11
- CVE-2026-4635Persistent notification timing attack causing server denial of serviceGo · github.com/mattermost/mattermost-server · fixed in 10.11.15+incompatible, 11.4.5+incompatible, 11.5.4+incompatible and more
- CVE-2026-3473Improper file ownership validation in the Boards API allows unauthorised file accessGo · github.com/mattermost/mattermost-server · fixed in 11.6.1, 11.5.4, 11.4.5 and more
- CVE-2026-4646Insufficient input validation in GitHub plugin API causes denial of serviceGo · github.com/mattermost/mattermost-plugin-github, github.com/mattermost/mattermost-server · fixed in 1.0.1-0.20260330164815-c2840e980b3c, 11.6.1, 11.5.4 and more
- CVE-2026-3636Sanitize team member data returned by APIGo · github.com/mattermost/mattermost-server · fixed in 10.11.15+incompatible, 11.4.5+incompatible, 11.5.4+incompatible and more
- CVE-2026-5740Unauthenticated WebSocket binary frame causes denial of service in Mattermost ServerGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 11.6.1, 11.5.4, 11.4.5 and more
- CVE-2026-5308Missing request body size limits on Zoom plugin HTTP endpointsGo · github.com/mattermost/mattermost-plugin-github, github.com/mattermost/mattermost-server · fixed in 1.0.1-0.20260410143745-9b41b1fd43c4, 11.6.1, 11.5.4 and more
- CVE-2026-5755Denial of service via crafted TIFF file uploadGo · github.com/mattermost/mattermost-server · fixed in 11.6.1, 11.5.4, 11.4.5 and more
- CVE-2026-46598Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agentGo · golang.org/x/crypto · fixed in 0.52.0
- CVE-2026-46595Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/sshGo · golang.org/x/crypto · fixed in 0.52.0
- CVE-2026-42508Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhostsGo · golang.org/x/crypto · fixed in 0.52.0
- CVE-2026-39834Invoking infinite loop on large channel writes in golang.org/x/crypto/sshGo · golang.org/x/crypto · fixed in 0.52.0
- CVE-2026-39831Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/sshGo · golang.org/x/crypto · fixed in 0.52.0
- CVE-2026-39829Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/sshGo · golang.org/x/crypto · fixed in 0.52.0
- CVE-2026-39830Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/sshGo · golang.org/x/crypto · fixed in 0.52.0
- CVE-2026-39827Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/sshGo · golang.org/x/crypto · fixed in 0.52.0
- CVE-2026-39835Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/sshGo · golang.org/x/crypto · fixed in 0.52.0
- CVE-2026-39828Invoking bypass of certificate restrictions in golang.org/x/crypto/sshGo · golang.org/x/crypto · fixed in 0.52.0
- CVE-2026-46597Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/sshGo · golang.org/x/crypto · fixed in 0.52.0
- CVE-2026-39832Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agentGo · golang.org/x/crypto · fixed in 0.52.0
- CVE-2026-39833Invoking key constraints not enforced in golang.org/x/crypto/ssh/agentGo · golang.org/x/crypto · fixed in 0.52.0