Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-102821Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekeycrates.io · russh · fixed in 0.63.2
- CVE-2026-102820pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)crates.io · pageant · fixed in 0.2.3
- CVE-2026-102677Electron: Sandboxed preload code cache can be poisoned by a compromised renderernpm · electron · fixed in 42.10.0, 43.5.0, 44.0.0-beta.6
- CVE-2026-102676Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictionsnpm · electron · fixed in 41.10.6, 42.9.2, 43.4.1 and more
- CVE-2026-102675Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnablednpm · electron · fixed in 41.10.6, 42.9.2, 43.4.1 and more
- CVE-2026-102674Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictionsnpm · electron · fixed in 41.10.6, 42.9.2, 43.4.1 and more
- CVE-2026-102673Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTabnpm · electron · fixed in 41.10.4, 42.5.2, 43.0.0
- CVE-2026-97711Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodiesnpm · serialize-javascript · fixed in 7.1.2
- CVE-2026-97689urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memoryPyPI · urllib3 · fixed in 2.8.0
- CVE-2026-97688urllib3: Chunked Deflate streaming can enter an infinite loopPyPI · urllib3 · fixed in 2.8.0
- CVE-2026-97687urllib3: HTTPS proxy TLS configuration may be ignored or overriddenPyPI · urllib3 · fixed in 2.8.0
- CVE-2026-102601Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapterPackagist · league/flysystem · fixed in 3.35.3
- CVE-2026-102600Socket.IO: Prototype Pollution via Unsafe Client Session Lookupnpm · @socket.io/cluster-engine · fixed in 0.1.1
- CVE-2026-102598Werkzeug safe_join() allows Windows special device namesPyPI · werkzeug · fixed in 3.1.9
- CVE-2026-63209Integer Overflow or Wraparound and Out-of-bounds Write in compressGo · github.com/klauspost/compress · fixed in 1.18.7
- CVE-2026-81930Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer token off-domainPyPI · apache-airflow-providers-snowflake · fixed in 6.18.0
- CVE-2026-81914Apache Airflow Google provider: Google Drive query injection via unescaped file and folder namesPyPI · apache-airflow-providers-google · fixed in 22.6.0
- CVE-2026-102422shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` tokennpm · shell-quote · fixed in 1.11.0
- CVE-2026-102414pbkdf2 rehashes long passwords on every iteration, enabling denial of servicenpm · pbkdf2 · fixed in 3.1.7
- CVE-2026-102281Nest: Remote process termination via a deeply nested microservice message patternnpm · @nestjs/microservices · fixed in 11.2.4, 12.0.2
- CVE-2026-102279Laravel: XSS in Debug Page InformationPackagist · laravel/framework · fixed in 12.69.0, 13.30.0
- CVE-2026-102278brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustionnpm · brace-expansion · fixed in 5.0.11, 3.0.8, 2.1.6 and more
- CVE-2026-102277brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of servicenpm · brace-expansion · fixed in 5.0.12, 3.0.9, 2.1.7 and more
- CVE-2026-102276brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustionnpm · brace-expansion · fixed in 5.0.10, 3.0.7, 2.1.5 and more
- CVE-2026-102265PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token headerPyPI · pyjwt · fixed in 2.14.0
- CVE-2026-102275PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusionPyPI · pyjwt · fixed in 2.15.0
- CVE-2026-102274PyJWT: Malformed RSA JWK aborts parsing of an entire JWK SetPyPI · pyjwt · fixed in 2.14.0
- CVE-2026-102273PyJWT accepts public JWK containers as HMAC secretsPyPI · pyjwt · fixed in 2.14.0
- CVE-2026-102272PyJWT BOM BypassPyPI · pyjwt · fixed in 2.14.0
- CVE-2026-102271PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guardPyPI · pyjwt · fixed in 2.14.0