Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-27140Code execution vulnerability in SWIG code generation in cmd/goGo · toolchain · fixed in 1.25.9, 1.26.2
- CVE-2026-32283Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tlsGo · stdlib · fixed in 1.25.9, 1.26.2
- CVE-2026-32288Unbounded allocation for old GNU sparse in archive/tarGo · stdlib · fixed in 1.25.9, 1.26.2
- CVE-2026-27143Missing bound checks can lead to memory corruption in safe Go in cmd/compileGo · toolchain · fixed in 1.25.9, 1.26.2
- CVE-2026-27144Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compileGo · toolchain · fixed in 1.25.9, 1.26.2
- CVE-2026-33810Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509Go · stdlib · fixed in 1.26.2
- CVE-2026-32289JsBraceDepth Context Tracking Bugs (XSS) in html/templateGo · stdlib · fixed in 1.25.9, 1.26.2
- CVE-2026-32282TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unixGo · stdlib · fixed in 1.25.9, 1.26.2
- CVE-2026-31040A vulnerability was identified in stata-mcp prior to v1.13.0 where insufficient validation of user-supplied Stata do-file content can lead tPyPI · stata-mcp · fixed in 1.13.0
- CVE-2026-39847Emmett has a path traversal in internal assets handlerPyPI · emmett · fixed in 2.8.1
- CVE-2026-39846SiYuan affected by Remote Code Execution in the Electron desktop client via stored XSS in synced table captionsGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260407035653-2f416e5253f1
- CVE-2026-35406Aardvark-dns has incorrect error handling for malformed tcp packetscrates.io · netavark · fixed in 1.17.1
- CVE-2026-34781Electron crashes in clipboard.readImage() on malformed clipboard image datanpm · electron · fixed in 39.8.5, 40.8.5, 41.1.0 and more
- CVE-2026-34765Electron named window.open targets not scoped to the opener's browsing contextnpm · electron · fixed in 39.8.5, 40.8.5, 41.1.0 and more
- CVE-2026-35568MCP Java-SDK has a DNS Rebinding VulnerabilityMaven · io.modelcontextprotocol.sdk:mcp-core · fixed in 1.0.0
- CVE-2026-35533mise has a local settings bypass config trust checkscrates.io · mise · fixed in 2026.6.4
- CVE-2026-33439Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAMMaven · org.openidentityplatform.openam:openam · fixed in 16.0.6
- CVE-2026-29181OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)Go · go.opentelemetry.io/otel · fixed in 1.41.0
- CVE-2026-39397@delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered collectionsnpm · @delmaredigital/payload-puck · fixed in 0.6.23
- CVE-2026-39395Cosign's verify-blob-attestation reports false positive when payload parsing failsGo · github.com/sigstore/cosign, github.com/sigstore/cosign/v2 +1 · fixed in 3.0.6, 2.6.3
- CVE-2026-39356SQL Injection via escapeName() in all Drizzle ORM SQL dialectsnpm · drizzle-orm · fixed in 0.45.2, 1.0.0-beta.20
- CVE-2026-39381Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields`npm · parse-server · fixed in 9.8.0-alpha.7, 8.6.75
- CVE-2026-39376FastFeedParser has an infinite redirect loop DoS via meta-refresh chainPyPI · fastfeedparser · fixed in 0.5.10
- CVE-2026-39373JWCrypto: JWE ZIP decompression bombPyPI · jwcrypto · fixed in 1.5.7
- CVE-2026-39371RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requestsnpm · rwsdk · fixed in 1.0.6
- CVE-2026-39370WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732)Packagist · wwbn/avideo
- CVE-2026-39369WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLsPackagist · wwbn/avideo
- CVE-2026-39368WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal servicesPackagist · wwbn/avideo
- CVE-2026-39367WWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG PagePackagist · wwbn/avideo
- CVE-2026-39366WWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.phpPackagist · wwbn/avideo