Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-110869Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexesnpm · nodemailer · fixed in 10.0.13
- CVE-2026-110864Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxynpm · better-auth · fixed in 1.7.7
- CVE-2026-110862Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Linknpm · better-auth · fixed in 1.7.7
- CVE-2026-110861Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Conditionnpm · @better-auth/drizzle-adapter, @better-auth/kysely-adapter +1 · fixed in 1.7.7, 1.7.0
- CVE-2026-110860GitPython 3.1.62 before 3.2.0 Symlink Path Traversal via Submodule.move()PyPI · gitpython · fixed in 3.2.0
- CVE-2026-110859GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch NamePyPI · gitpython · fixed in 3.2.0
- CVE-2026-110858GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() RefspecPyPI · gitpython · fixed in 3.2.0
- CVE-2026-110857GitPython before 3.2.0 Command Execution via ls_remote ext:: URLsPyPI · gitpython · fixed in 3.2.0
- CVE-2026-110856GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_datePyPI · gitpython · fixed in 3.2.0
- CVE-2026-110855GitPython before 3.2.0 Environment Variable Disclosure via .gitmodules Submodule NamePyPI · gitpython · fixed in 3.2.0
- CVE-2026-110816qs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a stringnpm · qs · fixed in 6.16.1
- CVE-2026-53999Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs)Go · github.com/radius-project/radius · fixed in 0.58.0
- CVE-2026-102748Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of ServiceGo · github.com/dgraph-io/dgraph/v25 · fixed in 25.4.0
- CVE-2026-102682Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creationPyPI · pipecat-ai · fixed in 1.6.0
- CVE-2026-55786Flyto2 Core: Unauthenticated Command Execution via HTTP MCP `execute_module`PyPI · flyto-core · fixed in 2.26.4
- CVE-2026-55787Flyto2 Core: SSRF guard bypass via IPv6 transition addresses (IPv4-mapped / 6to4 / NAT64) in validate_url_ssrfPyPI · flyto-core · fixed in 2.26.3
- CVE-2026-103975Appium: Symlink based Zip Slip in @appium/support ZIP extractionnpm · @appium/support · fixed in 7.2.6
- CVE-2026-96596erl_tar:extract/2 loops forever on a GNU sparse member with a trailing holeHex · hex_core · fixed in 0.20.1
- CVE-2026-105659HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in BanditHex · bandit · fixed in 1.13.0
- CVE-2026-59951MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource ExhaustionPyPI · mcp · fixed in 1.30.0, 2.2.0
- CVE-2026-77524KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthenticationGo · github.com/kedacore/keda, github.com/kedacore/keda/v2 · fixed in 2.21.0
- CVE-2026-77564Talos Linux: Support bundle does not redact registry credentialsGo · github.com/siderolabs/talos · fixed in 1.14.0-alpha.0.0.20260513110206-76080416beee
- CVE-2026-100169Account pre-hijacking in the Prowler API through email based social account linking without verificationPyPI · prowler-cloud · fixed in 5.30.3
- CVE-2026-102695OmniFaces: Forged combined-resource IDs and related output/push boundariesMaven · org.omnifaces:omnifaces · fixed in 1.14.3, 2.7.33, 3.14.23 and more
- CVE-2026-62858YOURLS: Unauthenticated File InclusionPackagist · yourls/yourls · fixed in 1.10.5
- CVE-2026-100394Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenantGo · github.com/nezhahq/nezha · fixed in 0.0.0-20260721131105-c893aa57867d
- CVE-2026-103929mise permits untrusted local configuration to override default shell argumentscrates.io · mise · fixed in 2026.7.14
- CVE-2026-101896Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR)npm · @angular/router · fixed in 22.2.0, 21.2.24, 20.3.32
- CVE-2026-101895Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPEnpm · @angular/platform-server · fixed in 22.1.6, 21.2.23, 20.3.31
- CVE-2026-107381svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferencesPackagist · enshrined/svg-sanitize · fixed in 1.0.0