Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-40312ImageMagick: Off-by-One in MSL decoder could result in crashNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.12.0
- CVE-2026-40311ImageMagick: Heap-use-after-free via XMP profile could result in a crash when printing valuesNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +14 · fixed in 14.12.0
- CVE-2026-40310ImageMagick: Heap out-of-bounds write in JP2 encoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +14 · fixed in 14.12.0
- CVE-2026-40183ImageMagick: Heap buffer overflow when encoding JXL image with a 16-bit floatNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.12.0
- CVE-2026-40169ImageMagick: Heap buffer overflow (WRITE) in the YAML and JSON encodersNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.12.0
- CVE-2026-34238ImageMagick: Integer overflow in despeckle operation causes heap buffer overflow on 32-bit buildsNuGet · magick.net-q16-anycpu, magick.net-q16-hdri-anycpu +4 · fixed in 14.12.0
- CVE-2026-33908ImageMagick is vulnerable to Stack Overflow in DestroyXMLTree()NuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.12.0
- CVE-2026-33905ImageMagick has an Out-of-Bounds read via -sample operationNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.12.0
- CVE-2026-33902ImageMagick: Stack Overflow via Recursive FX Expression ParsingNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.12.0
- CVE-2026-33901ImageMagick has a Heap Buffer Overflow via MVG decoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.12.0
- CVE-2026-33900ImageMagick has a Heap overflow caused by integer overflow/wraparound in viff encoder on 32-bit buildsNuGet · magick.net-q16-anycpu, magick.net-q16-hdri-anycpu +4 · fixed in 14.12.0
- CVE-2026-33899ImageMagick: Heap BufferOverflow write of single zero byte when parsing XMLNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.12.0
- CVE-2026-32272Craft Commerce: Blind SQL Injection via hasVariant/hasProductPackagist · craftcms/commerce · fixed in 5.6.0
- CVE-2026-32271Craft Commerce: SQL Injection can lead to Remote Code Execution via TotalRevenue WidgetPackagist · craftcms/commerce · fixed in 4.10.3, 5.5.5
- CVE-2026-6216DbGate SVG Icon String FontIcon.svelte cross site scriptingnpm · dbgate-web · fixed in 7.1.5
- CVE-2026-32270Craft Commerce: Unauthenticated information disclosure in `commerce/payments/pay` can leak some customer order data on anonymous paymentsPackagist · craftcms/commerce · fixed in 5.6.0, 4.11.0
- CVE-2026-28291simple-git has Command Execution via Option-Parsing Bypassnpm · simple-git · fixed in 3.32.0
- CVE-2026-23891Decidim has a Cross-site scripting (XSS) vulnerability via user name fieldRubyGems · decidim-core · fixed in 0.31.1, 0.30.5
- CVE-2026-1462Safe Mode Bypass in keras-team/kerasPyPI · keras · fixed in 3.13.2
- CVE-2026-33858Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (type/var) Bypass in XCom APIPyPI · apache-airflow, apache-airflow-core · fixed in 3.2.0
- CVE-2025-66236Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UIPyPI · apache-airflow, apache-airflow-core · fixed in 3.2.0
- CVE-2026-34476Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP ServerGo · github.com/apache/skywalking-mcp · fixed in 0.2.0
- CVE-2026-6204LibreNMS versions before 26.3.0 are affected by an authenticated remote code execution vulnerability by abusing the Binary Locations config Packagist · librenms/librenms · fixed in 26.3.0
- CVE-2026-2728LibreNMS versions before 26.3.0 are affected by an authenticated Cross-site Scripting vulnerability on the showconfig page.Packagist · librenms/librenms · fixed in 26.3.0
- CVE-2026-35337Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential HandlingMaven · org.apache.storm:storm-client · fixed in 2.8.6
- CVE-2026-35565Apache Storm UI: Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Storm UIMaven · org.apache.storm:storm-webapp · fixed in 2.8.6
- CVE-2026-4810Remote Code Execution in Google Agent Development Kit (ADK)PyPI · google-adk · fixed in 1.28.1, 2.0.0a2
- CVE-2019-25710Dolibarr ERP-CRM 8.0.4 SQL Injection via rowid ParameterPackagist · dolibarr/dolibarr
- CVE-2026-6125Dromara warm-flow Workflow Definition save-json SpelHelper.parseExpression code injectionMaven · org.dromara.warm:warm-flow-plugin-modes-sb · fixed in 1.8.5
- CVE-2026-6111FoundationAgents MetaGPT common.py decode_image server-side request forgeryPyPI · metagpt