Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-71397Unbounded request body accumulation on streaming RPCs causes memory exhaustion in grpc_serverHex · grpc_server · fixed in 1.0.6
- CVE-2026-102610fast-agent: `fast-agent serve` binds HTTP to 0.0.0.0 with no authentication by default; with --shell this is unauthenticated remote…PyPI · fast-agent-mcp · fixed in 0.7.21
- CVE-2026-102657esm.sh: web.NewHandler allows arbitrary file read via encoded dot-segment path traversalGo · github.com/esm-dev/esm.sh/web · fixed in 0.2.0
- CVE-2026-85737Velociraptor: Low-priv analyst reads arbitrary server files via ungated sql() VQL pluginGo · www.velocidex.com/golang/velociraptor · fixed in 0.77.2
- CVE-2026-59171JSON-java: JSONTokener Unbounded Numeric String Resource-Exhaustion DoSMaven · org.json:json · fixed in 20260719
- GHSA-47W9-6R3F-938GLXD has restricted project bypass leading to arbitrary command executionGo · github.com/canonical/lxd · fixed in 0.0.0-20260630083100-c5184be310b1
- GHSA-7MR3-28H5-M5VXLXD has project restriction bypass for custom volume copy across projectsGo · github.com/canonical/lxd · fixed in 0.0.0-20260630083100-c5184be310b1
- GHSA-QX75-2P3R-PWM5LXD has project restriction bypass in instance copy across projectsGo · github.com/canonical/lxd · fixed in 0.0.0-20260630083100-c5184be310b1
- CVE-2026-55649GeoNode has Stored XSS in Documents metadata abstract fieldPyPI · geonode · fixed in 5.0.3
- CVE-2026-46429GeoNode: Unrestricted File UploadPyPI · geonode · fixed in 5.0.3
- CVE-2026-33050GeoNode: OS command injection via uploaded file layer namePyPI · geonode · fixed in 5.1.0
- GHSA-PJFF-C2WC-F6JMLXD has arbitrary file write on client due to trusted image hashGo · github.com/canonical/lxd · fixed in 0.0.0-20260630083100-c5184be310b1
- GHSA-FMC8-P6Q7-75CCLXD has argument injection in backup compression algorithm leading to AFW and ACEGo · github.com/canonical/lxd · fixed in 0.0.0-20260630083100-c5184be310b1
- GHSA-VGHH-5RFX-XHQ8LXD has arbitrary file read+write on host via rootfs/ symlink in malicious imageGo · github.com/canonical/lxd · fixed in 0.0.0-20260630083100-c5184be310b1
- GHSA-JPF8-86F3-WP38LXD has arbitrary file read+write on host via templates/ symlink in malicious imageGo · github.com/canonical/lxd · fixed in 0.0.0-20260203144152-d1c8ba15d160
- GHSA-9J25-MM2H-2F76LXD has arbitrary file write on host via `exec-output` symlink in crafted imageGo · github.com/canonical/lxd · fixed in 0.0.0-20260626085134-124f90100640
- CVE-2026-108262DDEV incomplete tar symlink traversal fix allows host file overwrite - Incomplete fix of CVE-2026-32885Go · github.com/ddev/ddev · fixed in 1.25.4
- CVE-2026-75598Gradle Shadow: Zip Slip path traversal in ShadowCopyAction — no independent entry-name sanitizationMaven · com.gradleup.shadow:com.gradleup.shadow.gradle.plugin · fixed in 9.6.0
- CVE-2026-123824Symfony: XXE (Local File Read) in Config XmlUtils::parse() via validateOnParse = truePackagist · symfony/config · fixed in 5.4.56, 6.4.50, 7.4.23 and more
- CVE-2026-106128Prototype Pollution in Progress Software Kendo UI for Vuenpm · @progress/kendo-vue-common · fixed in 10.0.0
- CVE-2026-106127Prototype Pollution in Progress Software KendoReactnpm · @progress/kendo-react-common · fixed in 16.1.0
- CVE-2026-106144Prototype Pollution in Progress Software Kendo UI for Angularnpm · @progress/kendo-angular-common, @progress/kendo-angular-scheduler · fixed in 25.1.0
- CVE-2026-106143Cross-Site Scripting in Progress Software Kendo UI for Vuenpm · @progress/kendo-vue-editor · fixed in 10.1.0
- CVE-2026-106142Cross-Site Scripting in Progress Software KendoReactnpm · @progress/kendo-react-editor · fixed in 16.2.0
- CVE-2026-106141Cross-Site Scripting in Progress Software Kendo UI for Angularnpm · @progress/kendo-angular-editor · fixed in 25.3.0
- CVE-2026-106136Cross-Site Scripting in Progress Software KendoReactnpm · @progress/kendo-react-conversational-ui · fixed in 16.2.0
- CVE-2026-106134Cross-Site Scripting in Progress Software KendoReactnpm · @progress/kendo-react-layout · fixed in 16.2.0
- CVE-2026-106135Cross-Site Scripting in Progress Software Kendo UI for Angularnpm · @progress/kendo-angular-conversational-ui · fixed in 25.3.0
- CVE-2026-122053Symfony: ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested ObjectsPackagist · symfony/serializer · fixed in 5.4.56, 6.4.50, 7.1.0 and more
- CVE-2026-118515Symfony: The Serializer Builds UploadedFile Objects From Request Data, Letting a Client Point an Upload at Any Server FilePackagist · symfony/serializer · fixed in 5.4.56, 6.4.50, 7.4.23 and more