Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-119215AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's accountHex · ash_authentication · fixed in 5.0.0-rc.16
- CVE-2026-114582Server-side request forgery via SpatialReference string inputPyPI · django · fixed in 6.1.3, 6.0.10, 5.2.19
- CVE-2026-113733Password hash disclosure to "view only" admin users with custom user modelsPyPI · django · fixed in 6.1.3, 6.0.10
- CVE-2026-113593Potential exposure of private data via empty and missing Vary headersPyPI · django · fixed in 6.1.3, 6.0.10, 5.2.19
- CVE-2026-111362Server-side request forgery via crs member of GeoJSON geometriesPyPI · django · fixed in 6.1.3, 6.0.10, 5.2.19
- CVE-2026-111211Potential log injection via unescaped geometry form valuesPyPI · django · fixed in 6.1.3, 6.0.10, 5.2.19
- CVE-2026-108147Potential memory exhaustion in MultiPartParser via base64-encoded file uploadPyPI · django · fixed in 6.1.3, 6.0.10, 5.2.19
- CVE-2026-121564Silent loss of messages when merging overlapping chat exports in whatstkPyPI · whatstk · fixed in 0.9.0
- CVE-2026-121441Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 wasi-http Request Smugglingcrates.io · wasmtime-wasi-http · fixed in 36.0.19, 48.0.7, 49.0.4
- CVE-2026-121440Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 Forwarded Trailers Header Filter Bypasscrates.io · wasmtime-wasi-http · fixed in 48.0.7, 49.0.4
- CVE-2026-121439Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 HTTP Response Splitting via wasi-httpcrates.io · wasmtime-wasi-http · fixed in 48.0.7, 49.0.4
- CVE-2026-121426Nodemailer 3.0.0 before 10.1.4 Recipient Domain Confusion via addressparsernpm · nodemailer · fixed in 10.1.4
- RUSTSEC-2026-0440`astral-tokio-tar` is unmaintainedcrates.io · astral-tokio-tar
- RUSTSEC-2026-0452Out-of-bounds read when decoding internal keys shorter than 16 bytescrates.io · surrealkv · fixed in 1.2.0
- RUSTSEC-2026-0454Data race and double free via unsound `Send`/`Sync` in `reblessive`crates.io · surrealdb-core · fixed in 4.0.0
- CVE-2026-120327Open Redirection in extension "Mail" (mail)Packagist · mediaessenz/mail · fixed in 4.2.0, 3.12.5
- CVE-2026-120328Information Disclosure in extension "Mail" (mail)Packagist · mediaessenz/mail · fixed in 4.2.0, 3.12.5
- CVE-2026-120329Broken Access Control in extension "Mail" (mail)Packagist · mediaessenz/mail · fixed in 4.2.0, 3.12.5
- CVE-2026-120330Broken Access Control in extension "Mail" (mail)Packagist · mediaessenz/mail · fixed in 4.2.0, 3.12.5
- CVE-2026-120331Server-Side Request Forgery in extension "Mail" (mail)Packagist · mediaessenz/mail · fixed in 4.2.0, 3.12.5
- CVE-2026-120332Cross-Site Scripting in extension "Mail" (mail)Packagist · mediaessenz/mail · fixed in 4.2.0, 3.12.5
- CVE-2026-120333Broken Access Control in extension "Frontend User Registration" (sf_register)Packagist · evoweb/sf-register · fixed in 14.0.3, 13.2.5
- CVE-2026-119641Apache Oozie: workflow rerun bypasses the per-job ACL and reassigns ownershipMaven · org.apache.oozie:oozie-main
- CVE-2026-119724Apache JClouds: XML External Entity (XXE) in provider-response parsingMaven · org.apache.jclouds:jclouds-core
- CVE-2026-118448Uninitialized output buffer returned after nd_to_text failure in pybddisasmPyPI · pybddisasm
- CVE-2026-118447Uninitialized INSTRUX contents returned after decoding failure in pybddisasmPyPI · pybddisasm
- CVE-2026-118446Use-after-free in INSTRUX array members in pybddisasmPyPI · pybddisasm
- CVE-2026-118445Use-after-free in INSTRUX structure members in pybddisasmPyPI · pybddisasm
- CVE-2026-118444Out-of-bounds reads during instruction decoding in pybddisasmPyPI · pybddisasm
- CVE-2026-105770Octo STS discloses trust policy contents to unauthorized callers via Exchange error messagesGo · github.com/octo-sts/app · fixed in 0.11.2