Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-107806Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config OverwriteGo · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260728074146-a467ed652591
- CVE-2026-107805Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storageGo · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260901043436-8c9b9a1aff21
- CVE-2026-107804Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockoutGo · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260904075558-e30e331303fc
- CVE-2026-108106Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of ServiceMaven · org.xerial.snappy:snappy-java · fixed in 1.1.10.9
- CVE-2026-104635Uncontrolled recursion in elixir-protobuf/protobuf JSON decoding of self-referential messagesHex · protobuf · fixed in 0.17.1
- CVE-2026-101028Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sortsHex · ash · fixed in 3.34.6
- CVE-2026-97032HTTP/2 server crash due to HPACK encoder race in net/httpGo · golang.org/x/net, stdlib · fixed in 0.60.0, 1.26.9, 1.27.2
- CVE-2026-94439HTTP/1 server connection desynchronization after 2xx CONNECT response in net/httpGo · stdlib · fixed in 1.26.9, 1.27.2
- CVE-2026-78663Double flow control refund on HTTP/2 server streams in net/httpGo · golang.org/x/net, stdlib · fixed in 0.60.0, 1.26.9, 1.27.2
- CVE-2026-78669Excessive CPU consumption from repeated initial window changes in net/httpGo · golang.org/x/net, stdlib · fixed in 0.60.0, 1.26.9, 1.27.2
- CVE-2026-78660HTTP/2 transport accepts malformed framing-related headers in net/httpGo · golang.org/x/net, stdlib · fixed in 0.60.0, 1.26.9, 1.27.2
- CVE-2026-78667Lack of limit on size of parsed Range headers in net/httpGo · stdlib · fixed in 1.26.9, 1.27.2
- CVE-2026-94440Memory limit bypass when parsing MIME headers in net/textproto, mime/multipartGo · stdlib · fixed in 1.26.9, 1.27.2
- CVE-2026-97031Reject malformed ECH outer extension references in crypto/tlsGo · stdlib · fixed in 1.26.9, 1.27.2
- CVE-2026-56866HTTP/1 client connection desynchronization after CONNECT rejection in net/httpGo · stdlib · fixed in 1.26.9, 1.27.2
- CVE-2026-56857Root.Mkdir(All) can follow junctions out of the root on Windows in osGo · stdlib · fixed in 1.26.9, 1.27.2
- CVE-2026-78659HTTP/2 server memory exhaustion due to Trailer headers in net/httpGo · golang.org/x/net, stdlib · fixed in 0.60.0, 1.26.9, 1.27.2
- CVE-2026-94447Checksum database bypass for golang.org/toolchain in cmd/goGo · toolchain · fixed in 1.26.9, 1.27.2
- CVE-2026-94444Checksum bypass for golang.org/fips140 in cmd/goGo · toolchain · fixed in 1.26.9, 1.27.2
- CVE-2026-97030Recognize yield as regexp preceder keyword in html/templateGo · stdlib · fixed in 1.26.9, 1.27.2
- CVE-2026-94448Reset context tracking on consecutive template expressions in html/templateGo · stdlib · fixed in 1.26.9, 1.27.2
- CVE-2026-107728Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthyPyPI · strawberry-graphql · fixed in 0.326.1
- CVE-2026-107727Strawberry legacy graphql-ws retains naturally completed subscription slotsPyPI · strawberry-graphql · fixed in 0.327.2
- CVE-2026-107726Hazelcast: Arbitrary member memory access by low-privileged clientMaven · com.hazelcast:hazelcast · fixed in 5.7.0
- CVE-2026-107725Hazelcast: Authorization bypass in IMap Predicates APIMaven · com.hazelcast:hazelcast · fixed in 5.7.0
- CVE-2026-107724fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgerynpm · fast-jwt · fixed in 6.3.0
- CVE-2026-107723fast-jwt : Silent claim-validator bypass when JWT payload is a JSON arraynpm · fast-jwt · fixed in 6.3.0
- CVE-2026-107722fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusionnpm · fast-jwt · fixed in 6.3.0
- CVE-2026-107721fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)npm · fast-jwt · fixed in 6.3.0
- CVE-2026-107720fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly setnpm · fast-jwt · fixed in 6.3.1