Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-75507GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rulePyPI · graphql-core · fixed in 3.2.12, 3.3.0rc1
- CVE-2026-75508GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limitPyPI · graphql-core · fixed in 3.2.12, 3.3.0rc1
- CVE-2026-114603OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-apiPyPI · opentelemetry-api · fixed in 1.45.1
- CVE-2026-94482Next.js: Denial of Service in App Router using Server Actionsnpm · next · fixed in 15.5.28, 16.4.1
- CVE-2026-114510Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from…PyPI · flexible-graphrag · fixed in 0.8.2
- CVE-2026-113872multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardownnpm · multer · fixed in 2.5.0
- CVE-2026-111497Out-of-Bounds Write in Google Brotli DecoderPyPI · brotli, brotlicffi · fixed in 1.2.1, 1.2.1.0
- EEF-CVE-2026-111497Out-of-bounds write in the Brotli decoder bundled with erl-brotliHex · brotli · fixed in 0.3.4
- RUSTSEC-2026-0407SSRF and local file disclosure via unvalidated URLscrates.io · webpage · fixed in 2.1.0
- RUSTSEC-2026-0411Out-of-bounds read in `Log2Cache::nlog2n()`, `nlog2n_difference()` and `plog2p()`crates.io · dahl-salso · fixed in 0.7.0
- RUSTSEC-2026-0457OAuth client SSRF filter checks host strings, not resolved addressescrates.io · rmcp · fixed in 3.7.0
- CVE-2026-115324mem0 0.1.117 before 1.0.8 SQL Injection via Databricks Vector StorePyPI · mem0ai · fixed in 1.0.8
- CVE-2026-114665Goploy 1.18.0 before 1.18.1 Symlink Following Arbitrary File Read via /deploy/fileDiff and /deploy/fileCompareGo · github.com/zhenorzz/goploy · fixed in 1.18.0
- CVE-2026-93471Unbounded SAML message decompression in esaml allows memory exhaustionHex · esaml
- CVE-2026-86696Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustionHex · esaml
- CVE-2026-105270Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustionHex · esaml
- CVE-2026-84910Advanced Search - Moderately critical - Access bypass - SA-CONTRIB-2026-118Packagist · drupal/advanced_search · fixed in 2.4.5
- CVE-2026-84911AI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-119Packagist · drupal/ai · fixed in 1.3.13, 1.4.8
- CVE-2026-84912AI (Artificial Intelligence) - Moderately critical - Access Bypass - SA-CONTRIB-2026-120Packagist · drupal/ai · fixed in 1.3.13, 1.4.8
- CVE-2026-84913AI translate - Moderately critical - Access Bypass - SA-CONTRIB-2026-121Packagist · drupal/ai_translate · fixed in 1.3.2, 1.4.1
- CVE-2026-84914Calculate Working Days - Critical - Access bypass - SA-CONTRIB-2026-122Packagist · drupal/calculate_working_days · fixed in 2.0.3
- CVE-2026-84915Component blocks - Moderately critical - Cross site scripting - SA-CONTRIB-2026-123Packagist · drupal/component_blocks · fixed in 1.2.7
- CVE-2026-84916Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126Packagist · drupal/islandora · fixed in 2.19.0
- CVE-2026-84917Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127Packagist · drupal/jsonapi_role_access · fixed in 2.0.2
- CVE-2026-16648Mailer Plus Log - Moderately critical - Access bypass - SA-CONTRIB-2026-128Packagist · drupal/symfony_mailer_log · fixed in 1.2.7
- CVE-2026-81163Media Library Importer - Moderately critical - Access bypass - SA-CONTRIB-2026-129Packagist · drupal/media_library_importer · fixed in 2.1.6
- CVE-2026-84918Monobank payment API - Moderately critical - Access bypass - SA-CONTRIB-2026-130Packagist · drupal/monobank · fixed in 1.0.3
- CVE-2026-84919PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-131Packagist · drupal/photoswipe · fixed in 5.0.9
- CVE-2026-87936amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134Packagist · drupal/ai_provider_amazeeio · fixed in 1.3.7, 1.4.3
- CVE-2026-87937Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135Packagist · drupal/cas_server · fixed in 2.0.4, 2.1.3