Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-62268borg extract might modify out-of-tree files when extracting maliciously crafted archivesPyPI · borgbackup · fixed in 1.4.5, 2.0.0b22
- CVE-2026-34157Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOriginsGo · github.com/wailsapp/wails/v2 · fixed in 2.13.0
- CVE-2026-111753Angular: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)npm · @angular/common · fixed in 21.0.3, 20.3.34
- CVE-2026-114134Black: GitHub Action installs unvalidated required-version from pyproject.tomlPyPI · black · fixed in 26.10.1
- CVE-2026-46350dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASSnpm · dcmjs · fixed in 0.52.0
- CVE-2026-119434Decompression bomb in ezstd:decompress_using_ddict/2 allows BEAM memory exhaustion via unbounded output bufferHex · ezstd · fixed in 1.2.5
- CVE-2026-55458Caddy: RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak throughGo · github.com/caddyserver/caddy/v2 · fixed in 2.11.5
- CVE-2026-87008Code Graph RAG structural tools follow out-of-root symlinksPyPI · code-graph-rag · fixed in 0.0.587
- CVE-2026-77604Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readPyPI · code-graph-rag · fixed in 0.0.345
- CVE-2026-121949Symfony: HtmlSanitizer Does Not URL-Sanitize srcset and imagesrcset: Media Scheme and Host Allow-List BypassPackagist · symfony/html-sanitizer · fixed in 6.4.50, 7.4.23, 8.1.11
- CVE-2026-118517Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority (Incomplete Fix for…Packagist · symfony/http-client · fixed in 6.4.50, 7.4.23, 8.1.11
- CVE-2026-123125Symfony: Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses allowing SSRF Filter BypassPackagist · symfony/validator · fixed in 5.4.56, 6.4.50, 7.4.23 and more
- CVE-2026-123119Symfony: NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports…Packagist · symfony/http-client · fixed in 5.4.56, 6.4.50, 7.4.23 and more
- RUSTSEC-2026-0449`ocipkg` is unmaintainedcrates.io · ocipkg
- RUSTSEC-2026-0462Unbounded response body buffering in Streamable HTTP clientscrates.io · rmcp · fixed in 3.9.0
- CVE-2026-121489Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directoryMaven · org.apache.juneau:juneau-commons, org.apache.juneau:juneau-microservice-core · fixed in 9.2.1
- CVE-2026-96677Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chromeMaven · org.apache.juneau:juneau-marshall · fixed in 9.2.1
- CVE-2026-73117Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request dataMaven · org.apache.juneau:juneau-rest-server · fixed in 9.2.1
- CVE-2026-73116Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirectsMaven · org.apache.juneau:juneau-rest-client, org.apache.juneau:juneau-rest-common · fixed in 9.2.1
- CVE-2026-73101Apache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaultsMaven · org.apache.juneau:juneau-rest-server. · fixed in 9.2.1
- CVE-2026-73100Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errorsMaven · org.apache.juneau:juneau-rest-common, org.apache.juneau:juneau-rest-server · fixed in 9.2.1
- CVE-2026-73099Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body overrideMaven · org.apache.juneau:juneau-rest-server. · fixed in 9.2.1
- CVE-2026-73098Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsingMaven · org.apache.juneau:juneau-marshall · fixed in 9.2.1
- CVE-2026-73095Apache Juneau: Denial of service via unbounded memory allocation in parsers and REST request handlingMaven · org.apache.juneau:juneau-marshall, org.apache.juneau:juneau-rest-server · fixed in 9.2.1
- CVE-2026-123036A flaw was found in ansible-core.PyPI · ansible-core · fixed in 2.23.0
- CVE-2026-112072vault-java-driver: stored deeply nested JSON kills every thread that reads itMaven · io.github.jopenlibs:vault-java-driver · fixed in 7.0.0
- CVE-2026-109408vault-java-driver: SslConfig silently disables requested TLS verificationMaven · io.github.jopenlibs:vault-java-driver · fixed in 7.0.0
- CVE-2026-123012In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a…Go · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-115770Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofingGo · github.com/pocket-id/pocket-id/backend · fixed in 0.0.0-20260727180059-43aaccd5bfac
- CVE-2026-62662Pocket ID: Client credentials grant allows any OIDC client to obtain tokens for arbitrary audiencesGo · github.com/pocket-id/pocket-id/backend · fixed in 0.0.0-20260622164202-8158452b3730