Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-123859SQL Injection via unescaped DataFrame column names in Snowflake Connector for Python and Snowflake Connector for Python (Universal Core)PyPI · snowflake-connector-python · fixed in 4.8.1, 5.2.0
- CVE-2026-121623Symfony: DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files, Letting a Client Read Any Server FilePackagist · symfony/serializer · fixed in 5.4.56, 6.4.50, 7.4.23 and more
- CVE-2026-90436Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionNameMaven · axis:axis, org.apache.axis:axis
- CVE-2026-123792Symfony: Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document Hold a ProcessPackagist · symfony/yaml · fixed in 5.4.56, 6.4.50, 7.4.23 and more
- CVE-2026-123339Symfony: Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main RequestPackagist · symfony/http-kernel · fixed in 5.4.56, 6.4.50, 7.4.23 and more
- CVE-2026-118514Symfony: HEAD Requests Bypass the methods Option of security.access_control Rules and FirewallsPackagist · symfony/http-foundation · fixed in 5.4.56, 6.4.50, 7.4.23 and more
- CVE-2026-123746Symfony: Programmatic Logins Skip the checkPostAuth() Method of User CheckersPackagist · symfony/security-http · fixed in 5.4.56, 6.4.50, 7.4.23 and more
- RUSTSEC-2026-0443Hidden file disclosure through Windows short namescrates.io · actix-files · fixed in 0.7.4
- RUSTSEC-2026-0445Degraded secret zeroization capabilitiescrates.io · vodozemac · fixed in 0.11.2
- RUSTSEC-2026-0446Request smuggling through malformed chunked request trailerscrates.io · actix-http · fixed in 3.20.2
- RUSTSEC-2026-0447Compressed request bodies can exhaust memory before extractor limits applycrates.io · actix-web · fixed in 4.18.2
- RUSTSEC-2026-0448Unbounded decompression can exhaust memory and CPU resourcescrates.io · actix-http · fixed in 3.20.1
- RUSTSEC-2026-0451Degraded secret zeroization capabilitiescrates.io · vodozemac · fixed in 0.11.2
- RUSTSEC-2026-0455Large-window Brotli bodies bypass decompression memory limitscrates.io · actix-http · fixed in 3.20.3
- CVE-2026-85111Apache James: Denial of service upon MIME parsingMaven · org.apache.james:james-server · fixed in 3.9.1
- CVE-2026-85108Apache James MIME4J: Denial of service due to Allocation of Resources Without Limits or ThrottlingMaven · org.apache.james:apache-mime4j-core, org.apache.james:apache-mime4j-dom · fixed in 0.8.15
- CVE-2026-115701Cowboy HTTP/1.1 Unbounded Buffering of Pipelined Data During Request Handling Enables Memory ExhaustionHex · cowboy · fixed in 2.21.0
- CVE-2026-113431Unbounded decoded HTTP/2 header-list size in cowlib cow_http2_machine enables HPACK amplification memory exhaustionHex · cowlib · fixed in 2.22.0
- CVE-2026-66294XML injection in Saxy via unescaped CDATA section terminatorHex · saxy · fixed in 1.7.0
- CVE-2026-66295Processing instruction target and content emitted unescaped in Saxy encoder allows XML injectionHex · saxy · fixed in 1.7.0
- CVE-2026-66293XML comment injection in Saxy encoder via unescaped double hyphenHex · saxy · fixed in 1.7.0
- GO-2026-6893Event type spoofing via UntrustedType in github.com/google/go-eventlogGo · github.com/google/go-eventlog · fixed in 0.0.3-0.20261001001437-1991f15bc4b0
- GO-2026-6905Panic on negative member size in Reader.Read in github.com/blakesmith/arGo · github.com/blakesmith/ar
- GO-2026-6909Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/samlGo · github.com/crewjam/saml
- GO-2026-6911SSRF and credential leak via unvalidated Location header in github.com/mark3labs/mcp-goGo · github.com/mark3labs/mcp-go
- GO-2026-6906Netfoil doesn't decrement TTL in github.com/tinfoil-factory/netfoilGo · github.com/tinfoil-factory/netfoil · fixed in 0.6.1
- GO-2026-6907Arc has unauthenticated application log disclosure via `/api/v1/logs` in github.com/basekick-labs/arcGo · github.com/basekick-labs/arc · fixed in 0.0.0-20260615165136-bb7d9761ad98
- GO-2026-6894anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS in…Go · github.com/anacrolix/torrent · fixed in 1.61.1-0.20260911233437-76452a2c8a2f
- GO-2026-6891charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users in…Go · github.com/charmbracelet/soft-serve · fixed in 0.12.3
- GO-2026-6892charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories in github.com/charmbracelet/soft-serveGo · github.com/charmbracelet/soft-serve · fixed in 0.12.3