Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-42281MagicMirror²: Unauthenticated SSRF via /cors endpointnpm · magicmirror · fixed in 2.36.0
- CVE-2026-42283DevSpace UI Server WebSocket CheckOrigin does not validate sourceGo · github.com/loft-sh/devspace · fixed in 6.3.21
- CVE-2026-42590Gotenberg: ExifTool group-prefix syntax bypasses dangerous-tag blocklistGo · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8
- CVE-2026-42597Gotenberg: Chromium URL conversion routes read arbitrary files under /tmp via file:// schemeGo · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8 · fixed in 8.32.0
- CVE-2026-42595Gotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List BypassGo · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8 · fixed in 8.32.0
- CVE-2026-42594Gotenberg: Unauthenticated denial of service via echo.Context pool reuse in webhook async goroutineGo · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8 · fixed in 8.32.0
- CVE-2026-42593Gotenberg: Arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routesGo · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8
- CVE-2026-42592Gotenberg: DNS rebinding bypasses SSRF validation on Chromium URL conversion routesGo · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8
- CVE-2026-42591Gotenberg: Server-Side Request Forgery (SSRF) in github.com/gotenberg/gotenberg/v8Go · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8
- CVE-2026-42596Gotenberg: Unauthenticated SSRF via default deny-list bypass in downloadFrom and webhookGo · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8 · fixed in 8.32.0
- CVE-2026-40893Gotenberg: ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names Allows Arbitrary File Rename and MoveGo · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8
- CVE-2026-42589Gotenberg: Unauthenticated RCE via ExifTool Metadata Key InjectionGo · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8
- CVE-2026-44484Compromise of PyTorch Lightning PyPi Package VersionsPyPI · lightning, pytorch-lightning · fixed in 2.6.4
- CVE-2026-44216Wasmtime: Panic when allocating a table exceeding the size of the host's address spacecrates.io · wasmtime · fixed in 36.0.8, 43.0.2, 44.0.1
- CVE-2026-44308Spring Cloud AWS: Missing SNS message signature verification allows spoofing of HTTP/HTTPS endpoint notificationsMaven · io.awspring.cloud:spring-cloud-aws-sns · fixed in 4.0.2
- CVE-2026-42186OpenBao's Namespace Deletion May Not Delete Data ProperlyGo · github.com/openbao/openbao · fixed in 0.0.0-20260420173541-6d2e0506e2b4
- CVE-2026-44375Nerdbank.MessagePack: Attacker-controlled stackalloc in DateTime decoding causes process-terminating StackOverflowExceptionNuGet · nerdbank.messagepack · fixed in 1.1.62
- CVE-2026-44374Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checksnpm · @backstage/plugin-catalog-backend-module-unprocessed, @backstage/plugin-catalog-unprocessed-entities +1 · fixed in 0.6.11, 0.2.30, 0.0.15
- CVE-2026-42559RMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transportnpm · dynoxide · fixed in 0.9.13
- CVE-2026-43644podinfo 6.11.2 Reflected XSS via /echo EndpointGo · github.com/stefanprodan/podinfo · fixed in 1.8.1-0.20260519111337-cbebb20fd485
- CVE-2026-45205Apache Commons Configuration: StackOverflowError for YAML input with cyclesMaven · org.apache.commons:commons-configuration2 · fixed in 2.15.0
- CVE-2026-44919In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can occur via the file:///PyPI · ironic
- CVE-2026-44471gitoxide: Symlink prefix-reuse allows worktree escape during checkoutcrates.io · gix-fs · fixed in 0.21.1
- CVE-2026-44439LookyLoo - PlaywrightCapture permits access to local files and internal network resources during page capturePyPI · playwrightcapture · fixed in 1.39.6
- CVE-2026-44437Angular SSR: Open Redirect and Request Steering via Encoded X-Forwarded-Prefixnpm · @angular/ssr · fixed in 22.0.0-next.7, 21.2.9, 20.3.25 and more
- CVE-2026-44423ShellHub: Cross-tenant IDOR in `GET /api/sessions/:uid` discloses SSH session dataGo · github.com/shellhub-io/shellhub · fixed in 0.24.2
- CVE-2026-44424ShellHub: Cross-tenant IDOR in `GET /api/devices/:uid` discloses device data of any namespaceGo · github.com/shellhub-io/shellhub · fixed in 0.24.2
- CVE-2026-44426ShellHub: Cross-tenant IDOR in `GET /api/namespaces/:tenant` via API Key bypasses membership checkGo · github.com/shellhub-io/shellhub · fixed in 0.24.2
- CVE-2026-44425ShellHub: Crash-DoS via field injection in filter and sort-by parametersGo · github.com/shellhub-io/shellhub · fixed in 0.24.2
- CVE-2026-42561Python-Multipart: Denial of Service via unbounded multipart part headersPyPI · python-multipart · fixed in 0.0.27