Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-46498OpenAM Arbitrary OAuth Token Minting via Push RegistrationMaven · org.openidentityplatform.openam:openam-oauth2 · fixed in 16.1.1
- CVE-2026-45794OpenAM Unsafe Java Deserialization via SNSMaven · org.openidentityplatform.openam:openam-push-notification · fixed in 16.1.1
- CVE-2026-45048OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPCMaven · org.openidentityplatform.openam:openam-core · fixed in 16.1.1
- CVE-2026-44203OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)Maven · org.openidentityplatform.openam:openam-oauth2 · fixed in 16.1.1
- CVE-2026-44202OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`Maven · org.openidentityplatform.openam:openam-core · fixed in 16.1.1
- CVE-2026-62379OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallbackMaven · org.openidentityplatform.openam:openam-core · fixed in 16.1.2
- CVE-2026-53660OpenAM Insecure SSO Cookie InitializationMaven · org.openidentityplatform.openam:openam-core · fixed in 16.1.1
- CVE-2026-45052OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery EndpointsMaven · org.openidentityplatform.openam:openam-federation-library · fixed in 16.1.1
- CVE-2026-44793OpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via `FSUtils.postToTarget`Maven · org.openidentityplatform.openam:openam-federation-library · fixed in 16.1.1
- CVE-2026-90711proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnetnpm · proxy-addr · fixed in 2.0.8
- CVE-2026-17495moment vulnerable to Path Traversal via crafted non-string locale namenpm · moment · fixed in 2.31.0
- CVE-2026-76081ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role DeletionsGo · github.com/zitadel/zitadel · fixed in 4.16.0
- CVE-2026-53714Envoy Gateway: xDS Control Plane Information Disclosure when Envoy Gateway operates in GatewayNamespaceModeGo · github.com/envoyproxy/gateway · fixed in 1.8.1, 1.7.4
- CVE-2026-53716Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limitGo · github.com/envoyproxy/gateway · fixed in 1.8.1, 1.7.4
- CVE-2026-53715Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lockGo · github.com/envoyproxy/gateway · fixed in 1.8.1, 1.7.4
- CVE-2026-53719Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorizationGo · github.com/envoyproxy/gateway · fixed in 1.7.4, 1.8.1
- CVE-2026-53718Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypassGo · github.com/envoyproxy/gateway · fixed in 1.8.1, 1.7.4
- CVE-2026-53713Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret DisclosureGo · github.com/envoyproxy/gateway · fixed in 1.7.4, 1.8.1
- CVE-2026-53717Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar headerGo · github.com/envoyproxy/gateway · fixed in 1.7.4, 1.8.1
- CVE-2026-54559PocketSphinx: Buffer overflows in language and acoustic model loading codePyPI · pocketsphinx · fixed in 5.1.1
- CVE-2026-54334UEFI Firmware Parser: Heap out-of-bounds write in tiano decompressor `ReadCLen`PyPI · uefi-firmware
- CVE-2026-54333UEFI Firmware Parser: Stack out-of-bounds write in tiano decompressor MakeTablePyPI · uefi-firmware
- CVE-2026-54247Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoSGo · github.com/zalando/skipper · fixed in 0.26.22
- CVE-2026-54246Skipper routesrv-no-auth: All routesrv API Endpoints Lack AuthenticationGo · github.com/zalando/skipper · fixed in 0.27.13
- CVE-2026-65838Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstreamGo · github.com/zalando/skipper · fixed in 0.27.26
- CVE-2026-55244ASTEVAL: Sandbox Escape via BaseException SubclassesPyPI · asteval · fixed in 1.0.9
- CVE-2026-54632SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS)NuGet · sipsorcery · fixed in 10.0.9
- CVE-2026-54628Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server ModeGo · github.com/julien040/anyquery
- CVE-2026-50006Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server ModeGo · github.com/julien040/anyquery
- CVE-2026-54629Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server ModeGo · github.com/julien040/anyquery