Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-83616xmldom: Processing Instruction Target Injection Bypasses requireWellFormednpm · @xmldom/xmldom, xmldom · fixed in 0.8.15, 0.9.12
- CVE-2026-83615xmldom: Quadratic-memory consumptionnpm · @xmldom/xmldom, xmldom · fixed in 0.8.15, 0.9.12
- CVE-2026-83614xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text mergenpm · @xmldom/xmldom, xmldom · fixed in 0.8.15, 0.9.12
- CVE-2026-83613xmldom: Quadratic-time attribute deduplicationnpm · @xmldom/xmldom, xmldom · fixed in 0.8.15, 0.9.12
- CVE-2026-83612xmldom: HTML raw-text closing-tag case mismatch causes output amplificationnpm · @xmldom/xmldom · fixed in 0.9.12
- CVE-2026-83611xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing contentnpm · @xmldom/xmldom, xmldom · fixed in 0.8.15, 0.9.12
- CVE-2026-83610xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serializationnpm · @xmldom/xmldom, xmldom · fixed in 0.8.15, 0.9.12
- CVE-2026-83609xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization pathnpm · @xmldom/xmldom · fixed in 0.9.12
- CVE-2026-83608xmldom: DocType `name` Injection Bypasses requireWellFormednpm · @xmldom/xmldom, xmldom · fixed in 0.8.15, 0.9.12
- CVE-2026-83607xmldom: Element name injection via createElement() bypasses requireWellFormednpm · @xmldom/xmldom, xmldom · fixed in 0.9.11, 0.8.14
- CVE-2026-83606xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructionsnpm · @xmldom/xmldom · fixed in 0.9.11
- CVE-2026-83605xmldom: Attribute name injection via setAttribute() bypasses requireWellFormednpm · @xmldom/xmldom, xmldom · fixed in 0.9.11, 0.8.14
- CVE-2026-80047Hugging Face Transformers library writes remote code to disk prior to consent checkPyPI · transformers
- CVE-2026-84218Org.jolokia/jolokia-core: incomplete jndi denylist in jolokia jsr-160 proxy (bypass of cve-2018-1000130 fix)Maven · org.jolokia:jolokia-service-jsr160 · fixed in 2.6.2
- CVE-2026-84200Kyverno before v1.13.0 Policy Bypass via Multiple ExceptionsGo · github.com/kyverno/kyverno · fixed in 1.13.0
- CVE-2026-84199Kyverno before 1.16.2 SSRF via APICall FeatureGo · github.com/kyverno/kyverno · fixed in 1.16.2
- CVE-2026-84196Kyverno before 1.18.0 Server-Side Request Forgery via apiCallGo · github.com/kyverno/kyverno
- CVE-2026-84195Kyverno before 1.16.4 Credential Leak via apiCallGo · github.com/kyverno/kyverno · fixed in 1.17.0
- CVE-2026-84192LibreNMS before 26.3.1 Stored XSS via SNMP/Syslog DataPackagist · librenms/librenms · fixed in 26.5.0
- CVE-2026-84190LibreNMS before 26.5.0 Remote Code Execution via AboutControllerPackagist · librenms/librenms · fixed in 26.5.0
- CVE-2026-84189LibreNMS before 26.7.0 Stored XSS via Oxidized APIPackagist · librenms/librenms · fixed in 26.7.0
- CVE-2026-84188librenms before 26.7.0 Stored XSS via graph_descr settingsPackagist · librenms/librenms · fixed in 26.7.0
- CVE-2025-15613Kyverno before v1.13.4 SSRF via Service CallGo · github.com/kyverno/kyverno
- CVE-2023-54356Kyverno before 1.9.5 Sweet32 Medium Strength Cipher SuitesGo · github.com/kyverno/kyverno · fixed in 1.9.5
- CVE-2026-19032jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.PathMaven · com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind · fixed in 2.18.10, 2.21.6, 2.22.2 and more
- CVE-2026-82398pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespacePyPI · pypdf · fixed in 6.15.0
- CVE-2026-82397Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loopPyPI · tornado · fixed in 6.5.8
- CVE-2026-82396Sulu: Stored XSS via media download inline-disposition overridePackagist · sulu/sulu · fixed in 2.6.25, 3.0.8
- CVE-2026-82395Sulu: Media move/update authorization bypass (IDOR)Packagist · sulu/sulu · fixed in 2.6.25, 3.0.8
- CVE-2026-82394Sulu: Fix authorization bypass when creating preview linksPackagist · sulu/sulu · fixed in 2.6.25, 3.0.8