Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-44664fast-xml-builder: Comment Value bypass regexnpm · fast-xml-builder · fixed in 1.1.6
- CVE-2026-44665fast-xml-builder: Attribute values with unwanted quotes can bypass malicious or unwanted attributesnpm · fast-xml-builder · fixed in 1.1.7
- CVE-2026-44431urllib3: Sensitive headers forwarded across origins in proxied low-level redirectsPyPI · urllib3 · fixed in 2.7.0
- CVE-2026-44432urllib3: Decompression-bomb safeguards bypassed in parts of the streaming APIPyPI · urllib3 · fixed in 2.7.0
- CVE-2026-42266JupyterLab has an Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions install via POST request.PyPI · jupyterlab · fixed in 4.5.7
- CVE-2026-42557jupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted contentPyPI · jupyterlab, notebook · fixed in 4.5.7, 7.5.6
- CVE-2026-44459Hono: Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()npm · hono · fixed in 4.12.18
- CVE-2026-44458Hono: CSS Declaration Injection via Style Object Values in JSX SSRnpm · hono · fixed in 4.12.18
- CVE-2026-44457Hono: Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakagenpm · hono · fixed in 4.12.18
- CVE-2026-44456Hono: bodyLimit() can be bypassed for chunked / unknown-length requestsnpm · hono · fixed in 4.12.16
- CVE-2026-44455Hono: Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injectionnpm · hono · fixed in 4.12.16
- CVE-2026-44295protobufjs-cli: Code injection in pbjs static output from crafted schema namesnpm · protobufjs-cli · fixed in 1.2.1, 2.0.2
- CVE-2026-42290protobufjs-cli: OS Command Injectionnpm · protobufjs-cli · fixed in 1.2.1, 2.0.2
- CVE-2026-45740protobufjs: Denial of Service via unbounded recursive JSON descriptor expansionnpm · protobufjs · fixed in 7.5.8, 8.2.0
- CVE-2026-44294protobufjs: Denial of service from crafted field names in generated codenpm · protobufjs · fixed in 7.5.6, 8.0.2
- CVE-2026-44293protobufjs: Code injection through bytes field defaults in generated toObject codenpm · protobufjs · fixed in 7.5.6, 8.0.2
- CVE-2026-44292protobufjs: Prototype injection in generated message constructorsnpm · protobufjs · fixed in 7.5.6, 8.0.2
- CVE-2026-44291protobufjs: Code generation gadget after prototype pollutionnpm · protobufjs · fixed in 7.5.6, 8.0.2
- CVE-2026-44290protobufjs: Process-wide denial of service through unsafe option pathsnpm · protobufjs · fixed in 7.5.6, 8.0.2
- CVE-2026-44289protobufjs: Denial of service through unbounded protobuf recursionnpm · protobufjs · fixed in 7.5.6, 8.0.2
- CVE-2026-44288protobufjs: Overlong UTF-8 decodingnpm · @protobufjs/utf8, protobufjs · fixed in 1.1.1, 7.5.6, 8.0.2
- CVE-2026-41050Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template renderingGo · github.com/rancher/fleet · fixed in 0.15.1, 0.14.5, 0.13.10 and more
- CVE-2026-25705Rancher Extensions have arbitrary file access via path traversalGo · github.com/rancher/rancher · fixed in 2.14.1, 2.13.5, 2.12.9 and more
- CVE-2026-44245Kyverno: [policy-reporter-ui] XSS via Stored Property Values in PropertyCard ComponentGo · github.com/kyverno/policy-reporter-ui · fixed in 2.5.2+incompatible, 2.5.2
- CVE-2026-41901Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressionsMaven · org.thymeleaf:thymeleaf, org.thymeleaf:thymeleaf-spring5 +1 · fixed in 3.1.5.RELEASE
- CVE-2026-40863PhpSpreadsheet: CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML ReaderPackagist · phpoffice/phpspreadsheet · fixed in 5.7.0, 3.10.5, 2.4.5 and more
- CVE-2026-40902PhpSpreadsheet: CPU Denial of Service via Unbounded Row Number in XLSX Row DimensionsPackagist · phpoffice/phpspreadsheet · fixed in 5.7.0, 3.10.5, 2.4.5 and more
- CVE-2026-44307Mako: Path traversal via backslash URI on Windows in TemplateLookupPyPI · mako · fixed in 1.3.12
- CVE-2026-42545Granian: DoS via WSGI response header panicPyPI · granian · fixed in 2.7.4
- CVE-2026-42544Granian: Unauthenticated DoS via WebSocket subprotocol header panicPyPI · granian · fixed in 2.7.4