Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-81930Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer token off-domainPyPI · apache-airflow-providers-snowflake · fixed in 6.18.0
- CVE-2026-81914Apache Airflow Google provider: Google Drive query injection via unescaped file and folder namesPyPI · apache-airflow-providers-google · fixed in 22.6.0
- CVE-2026-102422shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` tokennpm · shell-quote · fixed in 1.11.0
- CVE-2026-102414pbkdf2 rehashes long passwords on every iteration, enabling denial of servicenpm · pbkdf2 · fixed in 3.1.7
- CVE-2026-102281Nest: Remote process termination via a deeply nested microservice message patternnpm · @nestjs/microservices · fixed in 11.2.4, 12.0.2
- CVE-2026-102279Laravel: XSS in Debug Page InformationPackagist · laravel/framework · fixed in 12.69.0, 13.30.0
- CVE-2026-102278brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustionnpm · brace-expansion · fixed in 5.0.11, 3.0.8, 2.1.6 and more
- CVE-2026-102277brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of servicenpm · brace-expansion · fixed in 5.0.12, 3.0.9, 2.1.7 and more
- CVE-2026-102276brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustionnpm · brace-expansion · fixed in 5.0.10, 3.0.7, 2.1.5 and more
- CVE-2026-102265PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token headerPyPI · pyjwt · fixed in 2.14.0
- CVE-2026-102275PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusionPyPI · pyjwt · fixed in 2.15.0
- CVE-2026-102274PyJWT: Malformed RSA JWK aborts parsing of an entire JWK SetPyPI · pyjwt · fixed in 2.14.0
- CVE-2026-102273PyJWT accepts public JWK containers as HMAC secretsPyPI · pyjwt · fixed in 2.14.0
- CVE-2026-102272PyJWT BOM BypassPyPI · pyjwt · fixed in 2.14.0
- CVE-2026-102271PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guardPyPI · pyjwt · fixed in 2.14.0
- CVE-2026-102270PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.PyPI · pyjwt · fixed in 2.14.0
- CVE-2026-102269PyJWT: Non-canonical signature segments enable raw-token revocation bypassPyPI · pyjwt · fixed in 2.14.0
- CVE-2026-102268PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guardPyPI · pyjwt · fixed in 2.14.0
- CVE-2026-102267PyJWT: PyJWKClient follows redirects when fetching JWKSPyPI · pyjwt · fixed in 2.14.0
- CVE-2026-102266PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validationPyPI · pyjwt · fixed in 2.14.0
- CVE-2026-101918PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)PyPI · pyjwt · fixed in 2.15.0
- CVE-2026-101917PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)PyPI · pyjwt · fixed in 2.14.0
- CVE-2026-101916@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorizednpm · @grpc/grpc-js · fixed in 1.13.6, 1.14.5
- CVE-2026-101915@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messagesnpm · @grpc/grpc-js · fixed in 1.13.6, 1.14.5
- CVE-2026-96760Authlib library contains a signature‑verification bypass vulnerabilityPyPI · authlib · fixed in 1.9.0
- CVE-2026-101914@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matchesnpm · @grpc/grpc-js-xds · fixed in 1.13.1, 1.14.1
- CVE-2026-101913ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hostsnpm · ip-address · fixed in 10.5.1
- CVE-2026-55156Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpointsnpm · @ooples/token-optimizer-mcp · fixed in 5.1.0
- CVE-2026-55157Token Optimizer MCP: OS command injection in smart_user via username in get-user-infonpm · @ooples/token-optimizer-mcp · fixed in 5.1.0
- CVE-2026-101912ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its rangenpm · ip-address · fixed in 10.7.1