Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-41428Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpointsnpm · @budibase/backend-core
- CVE-2026-41426pretalx: Email injection via unescaped user-controlled placeholders in pretalx mail templatesPyPI · pretalx · fixed in 2026.1.0
- CVE-2026-41425Authlib: Cross-site request forging when using cachePyPI · authlib · fixed in 1.6.11
- CVE-2026-41244Mojic: Observable Timing Discrepancy in HMAC Verificationnpm · mojic · fixed in 2.1.4
- CVE-2026-41894SiYuan: Incomplete Fix Bypass for CVE-2026-30869: Path Traversal via Double URL Encoding in `/export/` EndpointGo · github.com/siyuan-note/siyuan/kernel · fixed in 3.6.5
- CVE-2026-41326Kata Containers: CopyFile Policy Subversion via SymlinksGo · github.com/kata-containers/kata-containers · fixed in 0.0.0-20260422180503-1b9e49eb2763
- CVE-2026-41492Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in DgraphGo · github.com/dgraph-io/dgraph, github.com/dgraph-io/dgraph/v24 +2 · fixed in 25.3.3, 24.1.9
- CVE-2026-41327Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition FieldGo · github.com/dgraph-io/dgraph, github.com/dgraph-io/dgraph/v24 +2 · fixed in 25.3.3, 24.1.8
- CVE-2026-41328Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang FieldGo · github.com/dgraph-io/dgraph, github.com/dgraph-io/dgraph/v24 +2 · fixed in 25.3.3, 24.1.9
- CVE-2026-33524Zserio: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in DeserializationMaven · io.github.ndsev:zserio-runtime · fixed in 2.18.1
- CVE-2026-41907uuid: Missing buffer bounds check in `v3`/`v5`/`v6` when `buf` is providednpm · uuid · fixed in 11.1.1, 12.0.1, 13.0.1
- CVE-2026-42042Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercionnpm · axios · fixed in 1.15.1, 0.31.1
- CVE-2026-42039Axios: unbounded recursion in toFormData causes DoS via deeply nested request datanpm · axios · fixed in 1.15.1, 0.31.1
- CVE-2026-42036Axios: HTTP adapter streamed responses bypass maxContentLengthnpm · axios · fixed in 1.15.1, 0.31.1
- CVE-2026-42034Axios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0npm · axios · fixed in 1.15.1, 0.31.1
- CVE-2026-42037Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStreamnpm · axios · fixed in 1.15.1
- CVE-2026-42038Axios: no_proxy bypass via IP alias allows SSRFnpm · axios · fixed in 1.15.1, 0.31.1
- CVE-2026-42041Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategynpm · axios · fixed in 1.15.1, 0.31.1
- CVE-2026-42043Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0npm · axios · fixed in 1.15.1, 0.31.1
- CVE-2026-42044Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`npm · axios · fixed in 1.15.2
- CVE-2026-42040Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParamsnpm · axios · fixed in 1.15.1, 0.31.1
- CVE-2026-42035Axios: Header Injection via Prototype Pollutionnpm · axios · fixed in 1.15.1, 0.31.1
- CVE-2026-42033Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijackingnpm · axios · fixed in 1.15.1, 0.31.1
- CVE-2026-41680Marked: OOM Denial of Service via Infinite Recursion in marked Tokenizernpm · marked · fixed in 18.0.2
- CVE-2026-41898rust-openssl: Unchecked callback-returned length in PSK and cookie generate trampolines can cause OpenSSL to leak adjacent memory to the…crates.io · openssl · fixed in 0.10.78
- CVE-2026-41681rust-openssl: MdCtxRef::digest_final() writes past caller buffer with no length checkcrates.io · openssl · fixed in 0.10.78
- CVE-2026-41678rust-openssl: Incorrect bounds assertion in aes key wrapcrates.io · openssl · fixed in 0.10.78
- CVE-2026-41677rust-openssl: Out-of-bounds read in PEM password callback when user callback returns an oversized lengthcrates.io · openssl · fixed in 0.10.78
- CVE-2026-41676rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1crates.io · openssl · fixed in 0.10.78
- CVE-2026-41140Poetry: Path traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4PyPI · poetry · fixed in 2.3.4