Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-111766markdown-it: Quadratic-time denial of service in inline HTML parsing with html enablednpm · markdown-it · fixed in 14.3.3, 15.0.3
- CVE-2026-111759markdown-it: Quadratic complexity in smartquotes with unmatched closing quotesnpm · markdown-it · fixed in 15.0.2, 14.3.2
- CVE-2026-111757Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static pathsnpm · hono · fixed in 4.13.11
- CVE-2026-111755follow-redirects sensitiveHeaders regex escaping can expose credential headersnpm · follow-redirects · fixed in 1.16.1
- CVE-2026-111750AIOHTTP: Pure-Python parser request smugglingPyPI · aiohttp · fixed in 3.14.4
- CVE-2026-111749AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookiesPyPI · aiohttp · fixed in 3.14.4
- CVE-2026-111748AIOHTTP: Absolute-form request targets can spoof Request.schemePyPI · aiohttp · fixed in 3.14.4
- CVE-2026-111066AIOHTTP: File descriptor exhaustion in multipart requestsPyPI · aiohttp · fixed in 3.14.4
- CVE-2026-111065AIOHTTP: Connector pool exhaustion via Max-Age overflowPyPI · aiohttp · fixed in 3.14.4
- CVE-2026-111064aiohttp server lacks an initial request/header timeoutPyPI · aiohttp · fixed in 3.14.4
- CVE-2026-111063AIOHTTP: Secure attribute not enforced for shared cookiePyPI · aiohttp · fixed in 3.14.4
- CVE-2026-111061russh agent server converts constraint records into unbounded never-rolled-back taskscrates.io · russh · fixed in 0.64.1
- CVE-2026-111059Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTMLPyPI · mercury · fixed in 3.2.11
- CVE-2026-111058Mercury: Unauthenticated Remote Code Execution via /api/kernelsPyPI · mercury · fixed in 3.2.6
- CVE-2026-111057Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypassPyPI · mercury · fixed in 3.2.4
- RUSTSEC-2026-0453Use-after-free in KV backends via leaked `affinitypool::spawn_local` futurecrates.io · surrealdb · fixed in 3.3.0
- CVE-2026-88900Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code ExecutionMaven · org.apache.camel:camel-jgroups · fixed in 4.18.5, 4.22.1
- CVE-2026-85317Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token CacheMaven · org.apache.camel:camel-http · fixed in 4.18.5, 4.22.1
- CVE-2026-85316Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path MatchingMaven · org.apache.camel:camel-platform-http · fixed in 4.18.5, 4.22.1
- CVE-2026-85315Apache Camel: Camel-gRPC Information Disclosure via Unmuted Consumer ExceptionsMaven · org.apache.camel:camel-grpc · fixed in 4.18.5, 4.22.1
- CVE-2026-85314Apache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMultipart Data Format (Incomplete Fix of…Maven · org.apache.camel:camel-mail · fixed in 4.18.5, 4.22.1
- CVE-2026-85313Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is SetMaven · org.apache.camel:camel-jetty · fixed in 4.18.5, 4.22.1
- CVE-2026-85312Apache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Action HeaderMaven · org.apache.camel:camel-core · fixed in 4.18.5, 4.22.1
- CVE-2026-85296Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request StateMaven · org.apache.camel:camel-as2 · fixed in 4.18.5, 4.22.1
- CVE-2026-85260Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by DefaultMaven · org.apache.camel:camel-mllp · fixed in 4.18.5, 4.22.1
- CVE-2026-85257Apache Camel: Camel-CXF Information Disclosure via Unmuted Consumer ExceptionsMaven · org.apache.camel:camel-cxf · fixed in 4.18.5, 4.22.1
- CVE-2026-85254Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name CasingMaven · org.apache.camel:camel-platform-http · fixed in 4.18.5, 4.22.1
- CVE-2026-85251Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect TargetsMaven · org.apache.camel:camel-http · fixed in 4.18.5, 4.22.1
- CVE-2026-85250Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the documentType=InputSource OptionMaven · org.apache.camel:camel-xpath · fixed in 4.18.5, 4.22.1
- CVE-2026-85249Apache Camel: Camel-Tika Header Injection via Unfiltered Document MetadataMaven · org.apache.camel:camel-tika · fixed in 4.18.5, 4.22.1