Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-85250Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the documentType=InputSource OptionMaven · org.apache.camel:camel-xpath · fixed in 4.18.5, 4.22.1
- CVE-2026-85249Apache Camel: Camel-Tika Header Injection via Unfiltered Document MetadataMaven · org.apache.camel:camel-tika · fixed in 4.18.5, 4.22.1
- CVE-2026-85247Apache Camel: Camel-Knative Improper Certificate Validation When SSL Is Enabled Without a TruststoreMaven · org.apache.camel:camel-knative · fixed in 4.18.5, 4.22.1
- CVE-2026-85246Apache Camel: Camel-Mina Information Disclosure via Unmuted Consumer ExceptionsMaven · org.apache.camel:camel-mina · fixed in 4.18.5, 4.22.1
- CVE-2026-85245Apache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization TargetMaven · org.apache.camel:camel-thrift · fixed in 4.18.5, 4.22.1
- CVE-2026-85243Apache Camel: Camel-Crypto-PGP Integrity Verification Downgrade via Attacker-Controlled Message StructureMaven · org.apache.camel:camel-crypto-pgp · fixed in 4.18.5, 4.22.1
- CVE-2026-84181Apache Camel: Camel-Shiro Authentication Bypass via Skipped Credential Verification on Subject ReuseMaven · org.apache.camel:camel-shiro · fixed in 4.18.5, 4.22.1
- CVE-2026-84180Apache Camel: Camel-Knative Information Disclosure via Unmuted Consumer ExceptionsMaven · org.apache.camel:camel-knative · fixed in 4.18.5, 4.22.1
- CVE-2026-84176Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin ReflectionMaven · org.apache.camel:camel-platform-http-vertx · fixed in 4.18.5, 4.22.1
- CVE-2026-80344Apache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchronous MDN Delivery AddressMaven · org.apache.camel:camel-as2 · fixed in 4.18.5, 4.22.1
- CVE-2026-80343Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path MatchingMaven · org.apache.camel:camel-netty-http · fixed in 4.18.5, 4.22.1
- CVE-2026-79986Apache Camel: camel-azure-files resolved the remote path of a polled file from the name reported in the server directory listing without…Maven · org.apache.camel:camel-azure-files · fixed in 4.18.5, 4.22.1
- CVE-2026-79983Apache Camel: camel-ftp resolved the remote path of a polled file from the name reported in the server directory listing without…Maven · org.apache.camel:camel-ftp · fixed in 4.18.5, 4.22.1
- CVE-2026-78162Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865)Maven · org.apache.camel:camel-hazelcast · fixed in 4.18.5, 4.22.1
- RUSTSEC-2026-0414Exponential event growth with `ENABLE_WIKILINKS`crates.io · pulldown-cmark · fixed in 0.13.5
- CVE-2026-111997ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % charactersnpm · ip-address · fixed in 10.7.4
- CVE-2026-111933Coder before 2.34.2 User Enumeration via Login Placeholder HashGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.34.2, 2.33.8, 2.32.7 and more
- CVE-2026-111932Coder before 2.34.2 Stored HTML Injection via Appearance SettingsGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.34.2, 2.33.8, 2.32.7 and more
- CVE-2026-111922Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost OriginsGo · code.vikunja.io/api
- CVE-2026-111921Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share DeletionGo · code.vikunja.io/api · fixed in 2.7.0
- CVE-2026-111920Vikunja 2.6.0 Broken Access Control via Inherited Project PermissionsGo · code.vikunja.io/api
- CVE-2026-111919Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via WebhooksGo · code.vikunja.io/api
- CVE-2026-111918Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter CreationGo · code.vikunja.io/api · fixed in 2.7.0
- CVE-2026-111917Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session RevocationGo · code.vikunja.io/api
- CVE-2025-71435Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh TokenGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.23.0
- CVE-2024-58398Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect ParameterGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.16.1, 2.15.3, 2.14.4
- CVE-2026-108372LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown filesPyPI · loopx · fixed in 0.4.5
- CVE-2026-96627Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)Go · github.com/getarcaneapp/arcane/backend, github.com/getarcaneapp/arcane/backend/v2 · fixed in 2.6.0
- CVE-2026-96628Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`Go · github.com/getarcaneapp/arcane/backend, github.com/getarcaneapp/arcane/backend/v2 · fixed in 2.11.0
- CVE-2026-102834JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoSMaven · org.bytedeco:javacv · fixed in 1.5.14