Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-108949Apache ActiveMQ, ActiveMQ Broker: Repeated rejected temporary destination consumer requests can lead to broker OOMMaven · org.apache.activemq:activemq-broker · fixed in 6.3.3, 5.19.12
- CVE-2026-111751Angular: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)npm · @angular/router · fixed in 22.2.1, 21.2.25
- CVE-2026-111752Angular: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)npm · @angular/router · fixed in 22.2.1, 21.2.25, 20.3.33
- CVE-2026-55186Silverstripe MFA: Can bypass MFA during password reset flowPackagist · silverstripe/mfa · fixed in 6.0.0
- CVE-2026-64672Terragrunt catalog predictable temp symlink clobberGo · github.com/gruntwork-io/terragrunt · fixed in 1.1.1
- CVE-2026-76894CKAN MCP Server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)npm · @aborruso/ckan-mcp-server · fixed in 0.4.112
- CVE-2026-115878Stanza: RCE via pickle deserialization in the lemmatizerPyPI · stanza · fixed in 1.15.0
- CVE-2026-88968Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspacenpm · @anthropic-ai/claude-code · fixed in 2.1.251
- CVE-2026-121577Unescaped header separators in whatstk build a regular expression that backtracks exponentiallyPyPI · whatstk · fixed in 0.9.0
- CVE-2026-63395isomorphic-git: Arbitrary file write outside the working tree via a directory symlink during checkout (potential RCE)npm · isomorphic-git · fixed in 1.38.6
- CVE-2026-63475isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)npm · isomorphic-git · fixed in 1.38.6
- CVE-2026-63478isomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkoutnpm · isomorphic-git · fixed in 1.38.6
- CVE-2026-63501ag-psd: Uncontrolled Memory Allocation in PSD Layer Decoding (totalMemoryLimit bypass)npm · ag-psd · fixed in 31.0.1
- CVE-2026-110826AshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password changeHex · ash_authentication · fixed in 4.15.1, 5.0.0-rc.16
- CVE-2026-63471fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decoratorPyPI · fastapi-code-generator · fixed in 0.8.1
- CVE-2026-63469fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dictPyPI · fastapi-code-generator · fixed in 0.8.1
- CVE-2026-63470fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstringPyPI · fastapi-code-generator · fixed in 0.8.1
- CVE-2026-46487GeoNetwork: ACL bypass on Elasticsearch search when request body omits query fieldMaven · org.geonetwork-opensource:geonetwork · fixed in 4.2.16, 4.4.11
- CVE-2026-63198traQ: Privilege escalation by OAuth prompt=none requestGo · github.com/traptitech/traq · fixed in 1.0.0-rc.2.0.20260629134940-5510fe8aa9bb
- CVE-2026-63197traQ: XSS in the User Uploaded File Retrieval APIGo · github.com/traptitech/traq · fixed in 1.0.0-rc.2.0.20260627142846-3db29e777166
- CVE-2026-63417Logging Redactor: PII data in str/repr of non primitive objects was not being redactedPyPI · loggingredactor · fixed in 0.0.7
- CVE-2026-63499zt-zip: ZipUtil.unpack can change file permissions of output directoryMaven · org.zeroturnaround:zt-zip · fixed in 1.18.1
- CVE-2026-63436zt-zip: Path traversal in fluent API unpackMaven · org.zeroturnaround:zt-zip · fixed in 1.18.0
- CVE-2026-44267Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitternpm · @enspirit/elo · fixed in 1.0.1
- CVE-2026-44266Elo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labelsnpm · @enspirit/elo · fixed in 1.0.1
- CVE-2026-44265Elo: Code injection in Elo backends via unvalidated emission of programmatic AST fieldsnpm · @enspirit/elo · fixed in 1.0.1
- GHSA-P3JP-9V83-76W9Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write VulnerabilityNuGet · microsoft.dotnet.ilcompiler, microsoft.netcore.app.runtime.android-arm +75 · fixed in 8.0.33, 9.0.22, 10.0.14 and more
- GHSA-9PPR-WFW9-XVR2Netfoil doesn't decrement TTLGo · github.com/tinfoil-factory/netfoil · fixed in 0.6.1
- GHSA-M3QR-FVP4-78XJArc has unauthenticated application log disclosure via `/api/v1/logs`Go · github.com/basekick-labs/arc · fixed in 0.0.0-20260615165136-bb7d9761ad98
- CVE-2026-118505AshAuthentication brute_force_strategy does not limit sign-in and request actions defined on the resourceHex · ash_authentication · fixed in 5.0.0-rc.16