Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-40320Giskard has an Unsandboxed Jinja2 Template Rendering in ConformityCheckPyPI · giskard-checks · fixed in 1.0.2b1
- CVE-2026-40319Giskard has a Regular Expression Denial of Service (ReDoS) in RegexMatching CheckPyPI · giskard-checks · fixed in 1.0.2b1
- CVE-2026-40458Cross-Site Request Forgery in PAC4JMaven · org.pac4j:pac4j-core · fixed in 5.7.10, 6.4.1
- CVE-2026-5807Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey OperationsGo · github.com/hashicorp/vault
- CVE-2026-4525Vault Token Leaked to Backends via Authorization: Bearer Passthrough HeaderGo · github.com/hashicorp/vault
- CVE-2026-5052Vault Vulnerable to Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNSGo · github.com/hashicorp/vault
- CVE-2026-3605Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-ServiceGo · github.com/hashicorp/vault
- CVE-2026-31317Craftql v1.3.7 and before is vulnerable to Server-Side Request Forgery (SSRF) which allows an attacker to execute arbitrary code via the venPackagist · markhuot/craftql
- CVE-2026-40265Note Mark has Broken Access Control on Asset DownloadGo · github.com/enchant97/note-mark/backend · fixed in 0.0.0-20260411145023-6593898855ad
- CVE-2026-40263Note Mark: Username Enumeration via Login Endpoint Timing Side-ChannelGo · github.com/enchant97/note-mark/backend · fixed in 0.19.2-0.20260411145025-cf4c6f6acf70
- CVE-2026-40262Note Mark has Stored XSS via Unrestricted Asset UploadGo · github.com/enchant97/note-mark/backend · fixed in 0.0.0-20260411145018-6bb62842ccb9
- CVE-2026-40260pypdf: Manipulated XMP metadata entity declarations can exhaust RAMPyPI · pypdf · fixed in 6.10.0
- CVE-2026-40922SiYuan: Incomplete sanitization of bazaar README allows stored XSS via iframe srcdoc (incomplete fix for CVE-2026-33066)Go · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260414013942-62eed37a3263
- CVE-2026-40318SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`Go · github.com/siyuan-note/siyuan/kernel · fixed in 3.6.40.0.0-20260407035653-2f416e5253f1
- CVE-2026-40259SiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via removeUnusedAttributeView APIGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260407035653-2f416e5253f1
- CVE-2026-40255@adonisjs/http-server has an Open Redirect vulnerabilitynpm · @adonisjs/core, @adonisjs/http-server · fixed in 7.3.1, 8.2.0, 7.8.1
- CVE-2026-40249free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errorsGo · github.com/free5gc/udr
- CVE-2026-40248free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence SubscriptionsGo · github.com/free5gc/udr
- CVE-2026-40247free5gc UDR improper path validation allows unauthenticated access to Traffic Influence SubscriptionsGo · github.com/free5gc/udr
- CVE-2026-40246free5gc UDR improper path validation allows unauthenticated deletion of Traffic Influence SubscriptionsGo · github.com/free5gc/udr
- CVE-2026-40308My Calendar: Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blogPackagist · joedolson/my-calendar · fixed in 3.7.7
- CVE-2026-39313MCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transportnpm · mcp-framework · fixed in 0.2.22
- CVE-2026-35469SpdyStream: DOS on CRIGo · github.com/moby/spdystream · fixed in 0.5.1
- CVE-2026-34164Valtimo: Sensitive data exposure through inbox message logging in InboxHandlingServiceMaven · com.ritense.valtimo:inbox · fixed in 13.22.0.RELEASE
- CVE-2026-27820zlib: Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruptionRubyGems · zlib · fixed in 3.2.3, 3.1.2, 3.0.1
- CVE-2026-24749Silverstripe Assets Module has a DBFile::getURL() permission bypassPackagist · silverstripe/assets · fixed in 2.4.5, 3.1.3
- CVE-2026-6409Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted inputPackagist · google/protobuf · fixed in 4.33.6
- CVE-2026-33804@fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes optionnpm · @fastify/middie · fixed in 9.3.2
- CVE-2026-6270@fastify/middie vulnerable to middleware authentication bypass in child plugin scopesnpm · @fastify/middie · fixed in 9.3.2
- CVE-2026-31987Apache Airflow: JWT token appearing in logsPyPI · apache-airflow, apache-airflow-core · fixed in 3.2.0