Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-113797Electron: Extension tabs.query returns tab URLs and titles without the tabs permissionnpm · electron · fixed in 45.0.0-alpha.4, 44.1.1, 43.5.1 and more
- CVE-2026-113796Electron: SameSite cookie restrictions are not applied to windows opened from linksnpm · electron · fixed in 45.0.0-alpha.6, 44.3.0, 43.7.0 and more
- CVE-2026-113795pypdf: Possible large memory usage for streams with multiple filtersPyPI · pypdf · fixed in 6.20.0
- CVE-2026-113794pypdf: Possible infinite loop when hitting EOF in standard xref tablePyPI · pypdf · fixed in 6.20.0
- CVE-2026-113793pypdf: Possible infinite loop when removing tree itemsPyPI · pypdf · fixed in 6.20.1
- CVE-2026-113792pypdf: Possible infinite loop in PdfWriter.find_outline_itemPyPI · pypdf · fixed in 6.20.1
- CVE-2026-113791pypdf: Possible large memory usage when parsing content streamsPyPI · pypdf · fixed in 6.21.0
- CVE-2026-113790pypdf: Possible large memory usage when parsing arrays and dictionariesPyPI · pypdf · fixed in 6.21.0
- CVE-2026-113789pypdf: Possible long runtimes/large memory usage when retrieving form fieldsPyPI · pypdf · fixed in 6.21.0
- CVE-2026-113787odf-kit: HTML injection leading to XSS in odtToHtml() via unescaped style attribute valuesnpm · odf-kit · fixed in 0.14.2
- CVE-2026-113786pypdf: Unvalidated JPEG image data loadingPyPI · pypdf · fixed in 6.21.1
- CVE-2026-114437Chi Client IP Spoofing in ClientIPFromXFF via X-Forwarded-ForGo · github.com/go-chi/chi/v5 · fixed in 5.4.0
- CVE-2026-114386Pydantic AI Harness before 0.59.0 CodeMode Tool Call Limit Bypass via run_codePyPI · pydantic-ai-harness · fixed in 0.59.0
- CVE-2026-111943Distrust compromised intermediate certificates in crypto/x509Go · crypto/x509, stdlib · fixed in 1.26.10, 1.27.3
- CVE-2026-114113Sharp before 0.35.0 Multiple Vulnerabilities via Bundled libvips Image Decodersnpm · sharp · fixed in 0.35.0
- CVE-2026-114112Sharp before 0.35.4 RCE via bundled libheif AVIF decodingnpm · sharp · fixed in 0.35.4
- CVE-2026-114111Sharp before 0.35.5 RCE via librsvg Dependency Memory Vulnerabilitynpm · sharp · fixed in 0.35.5
- CVE-2026-114110Astral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD EntriesPyPI · uv · fixed in 0.11.6
- CVE-2026-114109uv before 0.11.15 Arbitrary File Write via Entry Point NamesPyPI · uv · fixed in 0.11.15
- CVE-2026-114108HKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCEPyPI · vibe-trading-ai · fixed in 0.1.7
- CVE-2026-114107HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunToolPyPI · vibe-trading-ai · fixed in 0.1.7
- CVE-2026-114106HKUDS Vibe-Trading 0.1.0 before 0.1.7 Path Traversal via read_document and safe_user_pathPyPI · vibe-trading-ai · fixed in 0.1.7
- CVE-2026-114104adm-zip before 0.6.1 Duplicate ZIP Entry Name Validation Bypassnpm · adm-zip · fixed in 0.6.1
- CVE-2026-114103adm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync()npm · adm-zip · fixed in 0.6.1
- CVE-2026-114102adm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error Eventnpm · adm-zip · fixed in 0.6.1
- CVE-2026-114101Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule BypassGo · github.com/corazawaf/coraza, github.com/corazawaf/coraza/v2 +1 · fixed in 3.8.1
- CVE-2026-114100Coraza from 3.0.4 before 3.8.1 Request Body Inspection Bypass via Content-TypeGo · github.com/corazawaf/coraza, github.com/corazawaf/coraza/v2 +1 · fixed in 3.8.1
- CVE-2026-114099Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key CollisionGo · github.com/corazawaf/coraza, github.com/corazawaf/coraza/v2 +1 · fixed in 3.8.1
- CVE-2026-114098Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop SymlinksPyPI · dulwich · fixed in 1.2.8
- CVE-2026-114097Dulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filter_branch Index FilterPyPI · dulwich · fixed in 1.2.8