Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-73494blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parserMaven · org.http4s:blaze-http_2.13, org.http4s:blaze-http_3 +1 · fixed in 0.23.18, 1.0.0-M42
- CVE-2026-53752docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of ServiceMaven · org.docx4j:docx4j-core · fixed in 11.5.14
- CVE-2026-53659http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoSMaven · org.http4k:http4k-core · fixed in 6.49.0.0, 5.42.0.0
- CVE-2026-47256OpenTelemetry: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer tokenGo · github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter · fixed in 0.154.0
- CVE-2026-55091flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id keynpm · flat-to-nested · fixed in 1.1.2
- CVE-2026-54150next-video: Unauthenticated arbitrary file read via /api/video request handlernpm · next-video · fixed in 2.8.1
- CVE-2026-55866SpiceDBChecks involving relations with caveats can result in unconditional permission when conditional permission is expectedGo · github.com/authzed/spicedb · fixed in 1.54.0
- CVE-2026-55847Allure: Stored XSS via unescaped ANSI helper in Allure report status message/trace renderingMaven · io.qameta.allure:allure-generator · fixed in 2.39.0
- CVE-2026-55846Allure: Path Traversal in Allure Report HTTP Server Allows Arbitrary File ReadMaven · io.qameta.allure:allure-commandline · fixed in 2.39.0
- CVE-2026-53495containerd CRI ExecSync Goroutine Leak Leading to Node-Level Denial of ServiceGo · github.com/containerd/containerd, github.com/containerd/containerd/v2 · fixed in 1.7.35, 2.0.12, 2.2.8 and more
- CVE-2026-54567Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)PyPI · flask-reuploaded · fixed in 1.6.0
- CVE-2026-49400October CMS: PHP Object Injection via Backend Widget Session StoragePackagist · october/system · fixed in 3.7.17, 4.2.23
- CVE-2026-70658pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifierRubyGems · pay
- CVE-2026-49250Conform: parseSubmission vulnerable to CPU exhaustion when parsing many unique form fieldsnpm · @conform-to/dom · fixed in 1.19.4
- CVE-2026-54087EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageFieldPackagist · easycorp/easyadmin-bundle · fixed in 5.0.13
- CVE-2026-34151XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+Maven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 17.10.5, 18.2.0
- CVE-2026-55253LangChain MongoDB: NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposurePyPI · langgraph-checkpoint-mongodb, langgraph-store-mongodb · fixed in 0.3.0, 0.4.0
- CVE-2026-46696October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder CallsPackagist · october/system · fixed in 3.7.17, 4.2.23
- CVE-2026-50157Auth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDKPackagist · auth0/symfony · fixed in 5.9.0
- CVE-2026-50276dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoSRubyGems · datadog · fixed in 2.32.0
- CVE-2026-50270dd-trace-java: Improper parsing of W3C baggage headers may lead to DoSMaven · com.datadoghq:dd-java-agent · fixed in 1.62.0
- CVE-2026-59960Argos JavaScript: CI Branch Name OS Command Injection in @argos-ci/corenpm · @argos-ci/core · fixed in 6.2.1
- CVE-2026-55102hashi-vault-js: Vault token and secret values exposed in thrown errorsnpm · hashi-vault-js · fixed in 0.5.2
- CVE-2026-55837dbt-mcp: Unauthenticated OAuth Context Endpoint Leaks dbt Platform TokensPyPI · dbt-mcp · fixed in 1.20.0
- CVE-2026-55073WeasyPrint restrictive URL fetcher bypass allows local file read and SSRFPyPI · weasyprint · fixed in 70.0
- CVE-2026-57579Alchemy: Unauthenticated nested page API leaks restricted & unpublished contentRubyGems · alchemy_cms · fixed in 8.2.6, 8.1.14, 8.0.15 and more
- CVE-2026-55416Pimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configuration Fields Without ParameterizationPackagist · pimcore/pimcore · fixed in 2026.1.6, 12.3.10, 11.5.19
- CVE-2026-55072Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table namePackagist · pimcore/pimcore · fixed in 2026.1.5, 12.3.9
- CVE-2026-55451gettext-converter: Prototype pollution in js2i18next() via crafted translation keysnpm · gettext-converter · fixed in 1.3.3
- CVE-2026-54452safeurl: Missing IPv6 CIDR Ranges in BlocklistGo · github.com/doyensec/safeurl · fixed in 0.2.4