Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-114614Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hostsPyPI · authlib · fixed in 1.8.0
- CVE-2026-115419Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Servernpm · @strands-agents/sdk · fixed in 1.5.0
- CVE-2026-115393Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 Cross-Engine Type Confusioncrates.io · wasmtime · fixed in 24.0.12, 36.0.13, 46.0.2 and more
- CVE-2026-115392Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 Sandbox Escape via Trailing Slashescrates.io · wasmtime · fixed in 24.0.13, 36.0.14, 46.0.3 and more
- CVE-2026-115391Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 Streamscrates.io · wasmtime · fixed in 46.0.3, 47.0.4
- CVE-2026-115390Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoScrates.io · wasmtime · fixed in 48.0.3, 49.0.1
- CVE-2026-115389Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val APIcrates.io · wasmtime · fixed in 36.0.16, 48.0.3, 49.0.1
- CVE-2026-115388Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Memory Exhaustion DoS via wasmtime-wasi-http Outgoing Body Writecrates.io · wasmtime-wasi-http · fixed in 36.0.16, 48.0.3, 49.0.1
- CVE-2026-115387Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Host Panic via WASI Filesystem Timestamp Overflowcrates.io · wasmtime-wasi · fixed in 36.0.16, 48.0.3, 49.0.1
- CVE-2026-115386Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Memory Disclosure via fd_readdircrates.io · wasmtime-wasi · fixed in 36.0.17, 48.0.4, 49.0.2
- CVE-2026-115385Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Host Panic via WASIp3 Timestampscrates.io · wasmtime-wasi · fixed in 48.0.4, 49.0.2
- CVE-2026-115384Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflowcrates.io · wasmtime · fixed in 48.0.4, 49.0.2
- CVE-2026-115383Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via Tag Importscrates.io · wasmtime · fixed in 48.0.4, 49.0.2
- CVE-2026-115382Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoScrates.io · wasmtime-wasi-http · fixed in 48.0.4, 49.0.2
- CVE-2026-115381Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroescrates.io · wasmtime-wasi · fixed in 36.0.17, 48.0.4, 49.0.2
- CVE-2026-115380Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Fuel Limit Bypass DoS via WASI Preview 0 poll_oneoffcrates.io · wasmtime-wasi · fixed in 36.0.17, 48.0.4, 49.0.2
- CVE-2026-115379Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via try_callcrates.io · wasmtime · fixed in 48.0.4, 49.0.2
- CVE-2026-115355Mistune before 3.3.0 Path Traversal and XSS via Include DirectivePyPI · mistune · fixed in 3.3.0
- CVE-2022-51026Bytebase 0.12.0 before 1.0.1 Authentication Bypass via GitLab Self-Hosted LoginGo · github.com/bytebase/bytebase · fixed in 1.0.1
- CVE-2026-114613MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failurePyPI · msgpack · fixed in 1.2.3
- CVE-2026-114612LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt KeyPyPI · litellm · fixed in 1.100.4, 1.101.3, 1.102.2 and more
- CVE-2026-108357PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of ServicePackagist · phpoffice/phpspreadsheet · fixed in 5.10.0, 3.10.8
- CVE-2026-108359PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)Packagist · phpoffice/phpspreadsheet · fixed in 5.10.0, 3.10.8, 2.4.8 and more
- CVE-2026-108358PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of ServicePackagist · phpoffice/phpspreadsheet · fixed in 5.10.0, 3.10.8, 2.4.8 and more
- CVE-2026-108360PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loadingPackagist · phpoffice/phpspreadsheet · fixed in 5.10.0, 3.10.8, 2.4.8 and more
- CVE-2026-114610fpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()'PyPI · fpdf2 · fixed in 2.8.8
- CVE-2026-114609fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled contentPyPI · fpdf2 · fixed in 2.8.8
- CVE-2026-114608Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOMEPyPI · pylint · fixed in 4.0.9
- CVE-2026-114607better-auth: OAuth state can be used as a Magic Link to sign in as another usernpm · better-auth · fixed in 1.7.7
- CVE-2026-114605dnspython dns.name.from_wire_parser() excessive CPU usePyPI · dnspython · fixed in 2.9.0