Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-32773Apache Spark: XSS Vulnerability in Spark Web 3.5.4PyPI · pyspark · fixed in 3.5.8
- CVE-2026-84375js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sourcesnpm · js-yaml · fixed in 4.3.2, 3.15.2
- CVE-2026-84374Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled pathPackagist · maatwebsite/excel · fixed in 3.1.70
- CVE-2026-84373Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mocknpm · @vitest/mocker, vitest · fixed in 4.1.11, 5.0.0-rc.2
- CVE-2026-75604Next.js: Unauthenticated Remote Code Execution on windows-hosted serversnpm · next · fixed in 15.5.24, 16.3.3
- CVE-2026-84372Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connectionsPackagist · predis/predis · fixed in 3.3.0
- CVE-2026-84371ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypassnpm · sanitize-html · fixed in 2.17.7
- CVE-2026-84370SVGO: removeScripts allows executable links through namespace and control-character bypassesnpm · svgo · fixed in 2.8.4, 3.3.5, 4.1.0
- CVE-2026-84369SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elementsnpm · svgo · fixed in 2.8.4, 3.3.5, 4.1.0
- CVE-2026-84368joi: Prototype pollution via a `proto` language key in custom messagesnpm · @hapi/joi, joi · fixed in 17.13.6, 18.2.5
- CVE-2026-84367joi: object().rename() with a template target can set the validated object's prototypenpm · joi · fixed in 17.13.5, 18.2.4
- CVE-2026-84366Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by defaultPyPI · scrapy · fixed in 2.17.0, 2.17
- CVE-2026-84365Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directorynpm · hono · fixed in 4.13.5
- CVE-2026-84364Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustionnpm · hono · fixed in 4.13.5
- CVE-2026-84363Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentialsnpm · hono · fixed in 4.13.5
- CVE-2026-63435Mail: Email address spoofing via malformed RFC 2047 encoded-wordsRubyGems · mail · fixed in 2.9.1
- CVE-2026-84361Composer: Perforce source URL permits P4PORT `rsh:` command executionPackagist · composer/composer · fixed in 2.10.3, 2.2.30
- CVE-2026-84311pypdf: Possible long runtimes/large memory usage when extracting XForm objectsPyPI · pypdf · fixed in 6.16.1
- CVE-2026-84310pypdf: Possible long runtimes/large memory usage when retrieving outlinesPyPI · pypdf · fixed in 6.16.1
- CVE-2026-84309pypdf: Possible infinite loop for TreeObject.insert_childPyPI · pypdf · fixed in 6.16.0
- CVE-2026-84308phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recoveryPackagist · phpseclib/phpseclib · fixed in 3.0.57, 4.0.1
- CVE-2026-84307Filament: Password validity disclosure for accounts denied panel access on login pagePackagist · filament/filament · fixed in 4.12.5, 5.7.5
- CVE-2026-84306Filament: Multi-factor authentication (app) codes can still be used after a newer code has been usedPackagist · filament/filament · fixed in 4.12.6, 5.7.6
- CVE-2026-84305sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumptionPyPI · sqlparse · fixed in 0.6.0
- CVE-2026-84304gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame FragmentationGo · google.golang.org/grpc · fixed in 1.83.1
- CVE-2026-84303gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasionGo · google.golang.org/grpc · fixed in 1.83.1
- CVE-2026-83557jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base typesMaven · com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind · fixed in 2.18.10, 2.21.6, 2.22.2 and more
- CVE-2026-83619xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parsernpm · @xmldom/xmldom · fixed in 0.8.15
- CVE-2026-83618xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminatornpm · @xmldom/xmldom · fixed in 0.9.12
- CVE-2026-83617xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminatornpm · @xmldom/xmldom · fixed in 0.9.12