Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-86041ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` headerGo · github.com/mayswind/ezbookkeeping · fixed in 1.6.0
- CVE-2026-76892tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP processnpm · @tsparticles/mcp-server · fixed in 4.3.1
- CVE-2026-76893tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clientsnpm · @tsparticles/mcp-server · fixed in 4.3.2
- CVE-2026-63655tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoSnpm · @tsparticles/mcp-server · fixed in 4.3.1
- CVE-2026-102895GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated…PyPI · gpustack · fixed in 2.2.0
- CVE-2026-102340Telepresence: Traffic Manager gRPC has no auth — any pod claims arbitrary namespace and intercepts services, receiving victim environment…Go · github.com/telepresenceio/telepresence · fixed in 2.31.0
- CVE-2026-122132go-chi chi 5.2.2 through 5.5.0 Open Redirect via RedirectSlashes MiddlewareGo · github.com/go-chi/chi, github.com/go-chi/chi/v2 +3 · fixed in 5.2.4
- CVE-2026-122131Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 Prototype Replacement via proto Language Keynpm · @hapi/joi, joi · fixed in 17.13.6, 18.2.5
- CVE-2026-102339Telepresence: Tunnel endpoint accepts caller-supplied session ID with no ownership proof — active client sessions hijackableGo · github.com/telepresenceio/telepresence/v2 · fixed in 2.31.0
- CVE-2026-97705Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parsernpm · moleculer · fixed in 0.15.2, 0.14.36
- CVE-2026-63183OmniAuth: Host Header Injection VulnerabilityRubyGems · omniauth · fixed in 2.2.0
- CVE-2026-121971Symfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path ReferencesPackagist · symfony/http-client · fixed in 5.4.56, 6.4.50, 7.4.23 and more
- CVE-2026-106554jackson-dataformat-cbor: quadratic-time TagList growth on unbounded stacked tags (CPU/GC DoS, PoC)Maven · com.fasterxml.jackson.dataformat:jackson-dataformat-cbor, tools.jackson.dataformat:jackson-dataformat-cbor · fixed in 2.18.12, 2.21.8, 2.22.4 and more
- CVE-2026-118391Unbounded query cache growth from interpolated JSON paths and splice lists in EctoHex · ecto · fixed in 3.14.3
- CVE-2026-121373Symfony: HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar (Incomplete Fix for…Packagist · symfony/html-sanitizer · fixed in 6.4.50, 7.4.23, 8.1.11
- CVE-2026-118516Symfony: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access ControlPackagist · symfony/routing · fixed in 5.4.56, 6.4.50, 7.4.23 and more
- CVE-2026-118513Symfony: X.509 Authentication Impersonation via DN Value Injection (incomplete fix for CVE-2026-45063)Packagist · symfony/security-http · fixed in 5.4.56, 6.4.50, 7.4.23 and more
- RUSTSEC-2026-0456Panic on an HEVC tile layout that does not match the active SPScrates.io · heifer-hevc-dec · fixed in 0.3.27
- RUSTSEC-2026-0458Memory exhaustion when parsing a crafted `iloc` boxcrates.io · heifer-isobmff · fixed in 0.3.27
- RUSTSEC-2026-0460Panic on chroma QP offsets enabled with an empty offset listcrates.io · heifer-hevc-dec · fixed in 0.3.27
- CVE-2026-114456Missing origin validation for the externalbrowser authenticator callback in multiple Snowflake client driversnpm · snowflake-sdk · fixed in 3.4.0
- CVE-2026-100302Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handlingMaven · org.apache.zookeeper:zookeeper
- CVE-2026-115448Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverableMaven · org.apache.zookeeper:zookeeper
- CVE-2026-100300Apache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node data and paths crashing the transaction-apply…Maven · org.apache.zookeeper:zookeeper
- CVE-2026-100252Apache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization IDMaven · org.apache.zookeeper:zookeeper
- CVE-2026-100235Apache ZooKeeper: ACL enforcement bypass allows unauthorized operations to commit after an ACL revocationMaven · org.apache.zookeeper:zookeeper
- CVE-2026-103582Apache ActiveMQ NMS OpenWire Client Library: Unbounded/Unvalidated Length Fields in Apache.NMS.OpenWire Unmarshalling (DoS)NuGet · apache.nms.activemq
- CVE-2026-108946Apache ActiveMQ, ActiveMQ Broker: The broker does not verify user provided connection id matches connectionMaven · org.apache.activemq:activemq-broker, org.apache.activemq:apache-activemq · fixed in 6.3.3, 5.19.12
- CVE-2026-111822Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocationMaven · org.apache.activemq:activemq-runtime-config, org.apache.activemq:apache-activemq · fixed in 6.3.3, 5.19.12
- CVE-2026-111821Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journalMaven · org.apache.activemq:activemq-kahadb-store, org.apache.activemq:apache-activemq · fixed in 6.3.3, 5.19.12