Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-107719fast-jwt: Verifier cache accepts expired JWTs without iat.npm · fast-jwt · fixed in 6.3.4
- CVE-2026-107718AdonisJS: Unencoded route parameters can produce open redirectsnpm · @adonisjs/http-server · fixed in 9.3.0, 8.2.3
- CVE-2026-107717Banks: User-controlled prompt input can be parsed as privileged chat messagesPyPI · banks · fixed in 2.5.0
- CVE-2026-107716Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistryPyPI · banks · fixed in 2.5.1
- CVE-2026-107715Mechanize sends credential headers to another host after an HTTP redirectRubyGems · mechanize · fixed in 2.14.1
- CVE-2026-107399Mechanize sends credential headers to another origin after a meta refreshRubyGems · mechanize · fixed in 2.14.1
- CVE-2026-106435Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python DriverPyPI · pymongo · fixed in 4.18.3
- CVE-2026-107397Indico: Cross-Site-Scripting in minutes editorPyPI · indico · fixed in 3.3.13
- CVE-2026-107396Indico: Cross-Site-Scripting in link fieldsPyPI · indico · fixed in 3.3.13
- CVE-2026-107395Indico: Missing access check in legacy session export APIPyPI · indico · fixed in 3.3.13
- CVE-2026-107394Indico: Incomplete Server-Side Request Forgery (SSRF) checkPyPI · indico · fixed in 3.3.13
- CVE-2026-107392music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of CVE-2026-32256)npm · music-metadata · fixed in 11.15.0
- CVE-2026-107391music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on masternpm · music-metadata · fixed in 11.16.0
- CVE-2026-107389music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abortnpm · music-metadata · fixed in 11.16.0
- CVE-2026-107388music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoSnpm · music-metadata · fixed in 11.16.0
- CVE-2026-107387music-metadata: Uncontrolled memory allocation in APEv2 parsernpm · music-metadata · fixed in 11.16.0
- CVE-2026-107386amqp091-go: Pre-negotiation frame limit is not enforced to 4KBGo · github.com/rabbitmq/amqp091-go · fixed in 1.14.0
- CVE-2026-107385MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPESnpm · mariadb · fixed in 3.2.5, 3.3.4, 3.4.7 and more
- CVE-2026-107384MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)npm · mariadb · fixed in 3.2.5, 3.3.4, 3.4.7 and more
- CVE-2026-107383MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parametersnpm · mariadb · fixed in 3.2.5, 3.3.4, 3.4.7 and more
- CVE-2026-107382MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLSnpm · mariadb · fixed in 3.5.4
- CVE-2026-107380enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference CollisionPackagist · enshrined/svg-sanitize · fixed in 1.0.0
- CVE-2026-107379enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration CrashPackagist · enshrined/svg-sanitize · fixed in 1.0.0
- CVE-2026-107378CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>PyPI · cairosvg · fixed in 2.9.1
- CVE-2026-107377datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directoryPyPI · datamodel-code-generator · fixed in 0.81.0
- CVE-2026-107376webonyx graphql-php: Unbounded recursion in parser causes stack overflow on crafted nested inputPackagist · webonyx/graphql-php · fixed in 15.32.3
- CVE-2026-107375JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssortnpm · generator-jhipster · fixed in 9.4.0
- CVE-2026-107303JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blobnpm · generator-jhipster, react-jhipster · fixed in 9.4.0, 1.1.0
- CVE-2026-107302msgpack5: Truncated map32 headers throw an unexpected errornpm · msgpack5 · fixed in 6.1.0
- CVE-2026-107301msgpack5: Partial options disable prototype protectionnpm · msgpack5 · fixed in 6.1.0