Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-44372Nitro: Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rulesnpm · nitro, nitropack · fixed in 3.0.260429-beta, 2.13.4
- CVE-2026-44373Nitro: Proxy scope bypass via percent-encoded path traversal in `routeRules`npm · nitro, nitropack · fixed in 3.0.260429-beta, 2.13.4
- CVE-2026-42304Twisted: Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer ChainsPyPI · twisted · fixed in 26.4.0, 26.4.0rc2
- CVE-2026-44368PyQuorum: Timing side‑channel in mul_modPyPI · pyquorum · fixed in 0.2.1
- CVE-2026-42602azureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replayGo · github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension · fixed in 0.151.0
- CVE-2026-33380SQL Expressions Read File From DiskGo · github.com/grafana/grafana · fixed in 1.9.2-0.20260513165311-fb7336fc36c1
- CVE-2026-33381Users can generate Service Account tokens after permissions removalGo · github.com/grafana/grafana · fixed in 1.9.2-0.20260513165311-fb7336fc36c1
- CVE-2026-42552Flight: Sensitive information disclosure via default error handler in flightphp/corePackagist · flightphp/core · fixed in 3.18.1
- CVE-2026-42551Flight: HTTP method override enabled by default enables CSRF escalation and middleware bypass in flightphp/corePackagist · flightphp/core · fixed in 3.18.1
- CVE-2026-42550Flight: SQL Injection via unvalidated identifiers in SimplePdo::insert / update / deletePackagist · flightphp/core · fixed in 3.18.1
- CVE-2026-42549Flight: Path traversal in `make:controller` CLI creates arbitrary directories outside project rootPackagist · flightphp/core · fixed in 3.18.1
- CVE-2026-42548Flight: Reflected XSS via unvalidated JSONP callback in Flight::jsonp()Packagist · flightphp/core · fixed in 3.18.1
- CVE-2026-44363Unsafe remote resource fetching in expansion misp-modulesPyPI · misp-modules · fixed in 3.0.8
- CVE-2026-44364misp-modules website - Missing CSRF protection in the website home blueprintPyPI · misp-modules
- CVE-2026-44351fast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypassnpm · fast-jwt · fixed in 6.2.4
- CVE-2026-42032CKAN: Unauthenticated Authorization Bypass in `datastore_search_sql`PyPI · ckan · fixed in 2.10.10, 2.11.5
- CVE-2026-41255CKAN: CSRF exemption primed by anonymous requestsPyPI · ckan · fixed in 2.10.10, 2.11.5
- CVE-2026-41132CKAN: No certificate validation on STMP connectionPyPI · ckan · fixed in 2.11.5, 2.10.10
- CVE-2026-42031CKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`PyPI · ckan · fixed in 2.10.10, 2.11.5
- CVE-2026-44248Netty: Resource exhaustion in MqttDecoderMaven · io.netty:netty-codec-mqtt · fixed in 4.2.13.Final, 4.1.133.Final
- CVE-2026-42587Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoSMaven · io.netty:netty-codec-http, io.netty:netty-codec-http2 · fixed in 4.2.13.Final, 4.1.133.Final
- CVE-2026-42586Netty: CRLF Injection in Netty Redis Codec EncoderMaven · io.netty:netty-codec-redis · fixed in 4.2.13.Final, 4.1.133.Final
- CVE-2026-42585Netty: HTTP Request Smuggling due to malformed Transfer-EncodingMaven · io.netty:netty-codec-http · fixed in 4.2.13.Final, 4.1.133.Final
- CVE-2026-42584Netty: HttpClientCodec response desynchronizationMaven · io.netty:netty-codec-http · fixed in 4.2.13.Final, 4.1.133.Final
- CVE-2026-42583Netty: Lz4FrameDecoder resource exhaustionMaven · io.netty:netty-codec, io.netty:netty-codec-compression · fixed in 4.1.133.Final, 4.2.13.Final
- CVE-2026-42582Netty: HTTP/3 QPACK literal unbounded allocationMaven · io.netty:netty-codec-http3 · fixed in 4.2.13.Final
- CVE-2026-42580Netty: HTTP Request Smuggling due to incorrect chunk size parsingMaven · io.netty:netty-codec-http · fixed in 4.2.13.Final, 4.1.133.Final
- CVE-2026-42579Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)Maven · io.netty:netty-codec-dns · fixed in 4.2.13.Final, 4.1.133.Final
- CVE-2026-42577Netty: epoll transport denial of service via RST on half-closed TCP connectionMaven · io.netty:netty-transport-classes-epoll · fixed in 4.2.13.Final
- CVE-2026-42578Netty: HTTP Header Injection via HttpProxyHandler Disabled ValidationMaven · io.netty:netty-handler-proxy · fixed in 4.1.133.Final, 4.2.13.Final