Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-42541Kubewarden: RBAC Reconnaissance via unchecked can_i host capability callGo · github.com/kubewarden/kubewarden-controller · fixed in 1.35.0
- CVE-2026-42175requests-hardened: Server-Side Request Forgery (SSRF) in requests-hardened RFC 6598PyPI · requests-hardened · fixed in 1.2.1
- CVE-2026-43929ssrfcheck: Server-Side Request Forgery (SSRF) and Incomplete List of Disallowed Inputsnpm · ssrfcheck
- CVE-2026-42048Langflow: Path Traversal in Langflow Knowledge Bases APIPyPI · langflow · fixed in 1.9.0
- CVE-2026-42303Fides: Privacy Request Identity Verification Bypass Vulnerability via Duplicate DetectionPyPI · ethyca-fides · fixed in 2.83.2
- CVE-2026-42300DevGuard: Unauthenticated identity assertion via `X-Admin-Token` headerGo · github.com/l3montree-dev/devguard · fixed in 1.2.2
- CVE-2026-44167phpseclib: CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID()Packagist · phpseclib/phpseclib · fixed in 1.0.29, 2.0.54, 3.0.52
- CVE-2026-44166Pocketbase: Account pre-hijacking via OAuth2 unverfied->verified autolinking upgradeGo · github.com/pocketbase/pocketbase · fixed in 0.22.42, 0.37.4
- CVE-2026-42899ASP.NET Core Denial of Service VulnerabilityNuGet · microsoft.aspnetcore.app.runtime.linux-arm, microsoft.aspnetcore.app.runtime.linux-arm64 +10 · fixed in 8.0.27, 9.0.16, 10.0.8
- CVE-2026-32175.NET Core Tampering VulnerabilityNuGet · microsoft.netcore.app.runtime.win-arm, microsoft.netcore.app.runtime.win-arm64 +2 · fixed in 8.0.27, 9.0.16, 10.0.8
- CVE-2026-35433.NET Elevation of Privilege VulnerabilityNuGet · microsoft.windowsdesktop.app.runtime.win-arm64, microsoft.windowsdesktop.app.runtime.win-x64 +1 · fixed in 8.0.27, 9.0.16, 10.0.8
- CVE-2026-33117Azure SDK for Java Security Feature Bypass VulnerabilityMaven · com.azure:azure-security-keyvault-keys · fixed in 4.10.6
- CVE-2026-43891changedetection.io: Arbitrary Local File Read via crafted backup restorePyPI · changedetection-io · fixed in 0.55.1
- CVE-2026-41895changedetection.io: XXE vulnerability in the changedetection.io projectPyPI · changedetection-io · fixed in 0.54.10
- CVE-2026-42045LobeHub: Cross-Site Scripting(XSS) escalate to Remote Code Execution(RCE)npm · @lobehub/lobehub
- CVE-2026-43515Apache Tomcat: Security constraints not correctly appliedMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 9.0.118, 10.1.55, 11.0.22
- CVE-2026-43514Apache Tomcat: AJP secret compared in non-constant timeMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 9.0.118, 10.1.55, 11.0.22
- CVE-2026-43513Apache Tomcat: LockOutRealm treats user names as case-sensitiveMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 9.0.118, 10.1.55, 11.0.22
- CVE-2026-43512Apache Tomcat: Digest authenticator will authenticate any unknown userMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 9.0.118, 10.1.55, 11.0.22
- CVE-2026-41293Apache Tomcat: HTTP/2 request headers not validatedMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 9.0.118, 10.1.55, 11.0.22
- CVE-2026-42498Apache Tomcat: WebSocket authentication header exposureMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 9.0.118, 10.1.55, 11.0.22
- CVE-2026-41284Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handlingMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 9.0.118, 10.1.55, 11.0.22
- CVE-2026-43983Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictionsGo · github.com/pocket-id/pocket-id/backend · fixed in 0.0.0-20260419162744-978ac87deffe
- CVE-2026-42260Open-WebSearch: SSRF in `fetchWebContent` MCP tool: bracketed IPv6 literals and non-resolving hostname check bypass `isPrivateOrLocalHostname`npm · open-websearch · fixed in 2.1.7
- CVE-2026-43937YAF.NET: Pre-Handler Authorization Bypass on Admin Pages Enabling Blind SQL Execution via `/Admin/RunSql`NuGet · yafnet.core · fixed in 4.0.5
- CVE-2026-43938YAF.NET: Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` HeaderNuGet · yafnet.core · fixed in 4.0.5, 3.2.12
- CVE-2026-43939YAF.NET: Stored XSS in Forum Thread Posts/Replies Allowing Arbitrary JavaScript Execution for All Thread ViewersNuGet · yafnet.core · fixed in 4.0.5, 3.2.12
- CVE-2026-43930Parse Server: MFA SMS one-time password accepted twice under concurrent loginnpm · parse-server · fixed in 9.9.0-alpha.2, 8.6.76
- CVE-2026-45091sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)npm · sealed-env · fixed in 0.1.0-alpha.4
- CVE-2026-41713Prompt Injection via Memory Poisoning in PromptChatMemoryAdvisorMaven · org.springframework.ai:spring-ai-client-chat · fixed in 1.0.7, 1.1.6