Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-41712ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakageMaven · org.springframework.ai:spring-ai-advisors-vector-store, org.springframework.ai:spring-ai-client-chat +1 · fixed in 1.0.7, 1.1.6, 2.0.0-M6
- CVE-2026-8162multiparty vulnerable to Denial of Service via Uncaught Exception in filename* parameter parsingnpm · multiparty · fixed in 4.3.0
- CVE-2026-8161multiparty vulnerable to Denial of Service via Prototype Pollution leading to Uncaught Exceptionnpm · multiparty · fixed in 4.3.0
- CVE-2026-8159multiparty vulnerable to ReDoS via filename parsingnpm · multiparty · fixed in 4.3.0
- CVE-2026-6402webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS originsnpm · webpack-dev-server · fixed in 5.2.4
- CVE-2026-45321Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keysnpm · @tanstack/arktype-adapter, @tanstack/eslint-plugin-router +40 · fixed in 1.166.16, 1.161.13, 0.0.8 and more
- CVE-2025-65719An issue in Open Source Kubectl MCP Server v1.1.1 allows attackers to execute arbitrary code on a victim system via user interaction with a npm · kubectl-mcp-server · fixed in 1.2.0
- CVE-2026-31220PySyft (Syft Datasite/Server) versions 0.9.5 and earlier are vulnerable to remote code execution due to insufficient validation and sandboxiPyPI · syft
- CVE-2026-31221PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability (CWE-502) in the checkpoint loading mechanismPyPI · lightning, pytorch-lightning
- CVE-2026-31222The snorkel library thru v0.10.0 contains an insecure deserialization vulnerability (CWE-502) in the Trainer.load() method of the Trainer clPyPI · snorkel
- CVE-2026-31223The snorkel library thru v0.10.0 contains a critical insecure deserialization vulnerability (CWE-502) in the BaseLabeler.load() method of thPyPI · snorkel
- CVE-2026-31224The snorkel library thru v0.10.0 contains an insecure deserialization vulnerability (CWE-502) in the MultitaskClassifier.load() method of thPyPI · snorkel
- CVE-2026-31225The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component.PyPI · superduper-framework
- CVE-2026-31233Guardrails AI thru 0.6.7 contains a code injection vulnerability (CWE-94) in its Hub package installation mechanism.PyPI · guardrails-ai
- CVE-2026-31234Horovod thru 0.28.1 contains an insecure deserialization vulnerability (CWE-502) in its KVStore HTTP server component.PyPI · horovod
- CVE-2026-31235The imgaug library thru 0.4.0 contains an insecure deserialization vulnerability in its BackgroundAugmenter class within the multicore.py moPyPI · imgaug
- CVE-2026-31236The llm CLI tool thru 0.27.1 contains a critical code injection vulnerability via its --functions command-line argument.PyPI · llm
- CVE-2026-31237The Ludwig framework thru 0.10.4 is vulnerable to insecure deserialization (CWE-502) through its predict() method.PyPI · ludwig
- CVE-2026-31238The Ludwig framework thru 0.10.4 is vulnerable to insecure deserialization (CWE-502) in its model serving component.PyPI · ludwig
- CVE-2026-31239The mamba language model framework thru 2.2.6 is vulnerable to insecure deserialization (CWE-502) when loading pre-trained models from HuggiPyPI · mamba-ssm
- CVE-2026-31240The mem0 1.0.0 server lacks authentication and authorization controls for its memory management API endpoints.PyPI · mem0ai
- CVE-2026-31241The mem0 1.0.0 server lacks authentication and authorization controls for its memory deletion API endpoint (DELETE /memories).PyPI · mem0ai
- CVE-2026-31245The mem0 1.0.0 server lacks authentication and authorization controls for its memory creation API endpoint (POST /memories).PyPI · mem0ai
- CVE-2026-8349omec-project amf NGAP Message memory corruptionGo · github.com/omec-project/amf
- CVE-2026-43901Wireshark MCP: Arbitrary file write via export_objects when WIRESHARK_MCP_ALLOWED_DIRS is not configuredPyPI · wireshark-mcp
- CVE-2026-42554Fiber: XSS in AutoFormat Content NegotiationGo · github.com/gofiber/fiber/v2, github.com/gofiber/fiber/v3 · fixed in 2.52.13, 3.2.0
- CVE-2026-42188Geyser: Server-Side Request Forgery (SSRF) via Player Head Texture URLMaven · org.geysermc.geyser:core · fixed in 2.9.3
- CVE-2026-43897Link Preview JS: vunerable to IPv6 and internal loopback attacksnpm · link-preview-js · fixed in 4.0.1
- CVE-2026-43893exiftool-vendored: Argument injection via newline characters in tag namesnpm · exiftool-vendored · fixed in 35.19.0
- CVE-2026-42600MinIO: Path Traversal via msgpack Body in `ReadMultiple` Storage-REST EndpointGo · github.com/minio/minio · fixed in 0.0.0-20260414213245