Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-71328.NET and Visual Studio Remote Code Execution VulnerabilityNuGet · microsoft.diasymreader.native · fixed in 18.9.0-beta1.26405.2
- CVE-2026-69304ASP.NET Core Denial of Service VulnerabilityNuGet · microsoft.aspnetcore.server.iisintegration · fixed in 11.0.0-rc.1, 8.0.31, 9.0.20 and more
- CVE-2026-69439.NET and Visual Studio Elevation of Privilege VulnerabilityNuGet · microsoft.diasymreader.native · fixed in 18.9.0-beta1.26405.2
- CVE-2026-72923Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansionNuGet · microsoft.openapi.readers, microsoft.openapi.yamlreader · fixed in 1.6.30, 3.10.0, 2.12.0
- CVE-2026-69522.NET and Visual Studio Remote Code Execution VulnerabilityNuGet · microsoft.diasymreader.native · fixed in 18.9.0-beta1.26405.2
- CVE-2026-86073n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitutionnpm · n8n · fixed in 2.38.1, 2.37.7
- CVE-2026-82533DeepSeek Harness < 0.1.2-alpha.1 Authentication Bypass via Host Header Spoofingnpm · @deepseek-ai/dsh-client-connection · fixed in 0.1.2-alpha.1
- CVE-2026-86597Sensitive information written to logs by Snowflake driversnpm · snowflake-sdk · fixed in 3.3.0
- CVE-2026-76969Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)npm · @sap/cds-mtxs · fixed in 4.0.3, 3.9.7, 2.7.7 and more
- CVE-2026-86540knowns before 0.30.0 Arbitrary Code Execution via LSP Binarynpm · knowns · fixed in 0.30.0
- CVE-2026-86439knowns before 0.30.0 Path Traversal via MCP doc and memory toolsnpm · knowns · fixed in 0.30.0
- CVE-2022-51018PocketMine-MP before 3.26.5 and 4.0.5 Input Validation via Book PagesPackagist · pocketmine/pocketmine-mp · fixed in 3.26.5, 4.0.5
- CVE-2022-51017PocketMine-MP before 3.26.5 and 4.0.5 Denial of Service via Skin DataPackagist · pocketmine/pocketmine-mp · fixed in 3.26.5, 4.0.5
- CVE-2022-51016PocketMine-MP 3.x before 3.27.0 Authentication Bypass via Login ReplayPackagist · pocketmine/pocketmine-mp · fixed in 4.0.0
- CVE-2022-51015PocketMine-MP before 4.0.6 Denial of Service via PlayerActionPacketPackagist · pocketmine/pocketmine-mp · fixed in 4.0.6
- CVE-2022-51014PocketMine-MP before 4.0.7 Denial of Service via JSON DecodingPackagist · pocketmine/pocketmine-mp · fixed in 4.0.7
- CVE-2022-51013PocketMine-MP before 4.2.3 Denial of Service via NBT MetadataPackagist · pocketmine/pocketmine-mp · fixed in 4.2.4
- CVE-2022-51012PocketMine-MP before 4.2.9 Denial of Service via NBT DeserializationPackagist · pocketmine/pocketmine-mp · fixed in 4.2.9
- CVE-2022-51011PocketMine-MP before 4.2.10 Denial of Service via Chat MessagesPackagist · pocketmine/pocketmine-mp · fixed in 4.2.10
- CVE-2022-51010PocketMine-MP before 4.4.2 Server Crash via Item IDPackagist · pocketmine/pocketmine-mp · fixed in 4.4.2
- CVE-2026-86434commonmark 2.0.0 through 2.8.3 Denial of Service via Slug CollisionPackagist · league/commonmark · fixed in 2.9.0
- CVE-2026-86431commonmark before 2.9.1 XSS via AttributesExtension form feed bypassPackagist · league/commonmark · fixed in 2.9.1
- CVE-2026-86430league/commonmark before 2.9.1 Denial of Service via parsingPackagist · league/commonmark · fixed in 2.9.1
- CVE-2026-86429commonmark before 2.9.1 Denial of Service via SmartPunct and AttributesPackagist · league/commonmark · fixed in 2.9.1
- CVE-2026-86428commonmark 1.5.0 before 2.10.0 Denial of Service via AttributesPackagist · league/commonmark · fixed in 2.10.0
- CVE-2026-86257wger before 2.6 CSV Formula Injection via member exportPyPI · wger · fixed in 2.6
- CVE-2026-86256wger before 2.6 Open Redirect via trainer-login next parameterPyPI · wger · fixed in 2.6
- CVE-2026-86255wger before 2.5 Uncontrolled Resource Consumption via date_sequencePyPI · wger
- CVE-2026-86253h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segmentsnpm · h3 · fixed in 2.0.1-rc.15, 1.15.6
- CVE-2026-86252h3 before 1.15.9 SSE Event Injection via Carriage Returnnpm · h3 · fixed in 2.0.1-rc.17, 1.15.9