Skip to main content
cve.nowby Sazabi
Rankings

Rankings: This week's worst packages

Open source packages ranked by the score of their worst CVE published or escalated in the window, then by how many they have. How the score works.

  1. 185code.gitea.io/giteaWorst: CVE-2026-60004 · Gitea · gitea.dev +1: Remote code execution in diffpatch API via Git hooksGo1 CVE in this window
  2. 285gitea.devWorst: CVE-2026-60004 · Gitea · gitea.dev +1: Remote code execution in diffpatch API via Git hooksGo1 CVE in this window
  3. 383gogs.io/gogsWorst: CVE-2025-8110 · Gogs · gogs.io/gogs: File overwrite in file update API via symlinksGo2 CVEs in this window
  4. 468org.openidentityplatform.openam:openamWorst: CVE-2026-33439 · OpenIdentityPlatform OpenAM · org.openidentityplatform.open…: Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAMMaven1 CVE in this window
  5. 566io.netty:netty-codec-http2Worst: CVE-2026-33871 · netty · io.netty:netty-codec-http2: Denial of service in HTTP/2 CONTINUATION handlingMaven1 CVE in this window
  6. 663payloadWorst: CVE-2026-105863 · payloadcms payload · payload: Payload authentication token field handling issuenpm1 CVE in this window
  7. 760nodemailerWorst: CVE-2026-121426 · nodemailer: Recipient allow list bypass in addressparsernpm1 CVE in this window
  8. 859PmonaiWorst: CVE-2026-48705 · Project-MONAI MONAI · monai: Denial of service and data corruption in DICOM parsingPyPI1 CVE in this window
  9. 957rustls-webpkiWorst: CVE-2026-111943 · Go standard library crypto/x509 · stdlib +3: Distrust compromised intermediate certificates in crypto/x509crates.io1 CVE in this window
  10. 1057webpki-root-certsWorst: CVE-2026-111943 · Go standard library crypto/x509 · stdlib +3: Distrust compromised intermediate certificates in crypto/x509crates.io1 CVE in this window
  11. 1157webpki-rootsWorst: CVE-2026-111943 · Go standard library crypto/x509 · stdlib +3: Distrust compromised intermediate certificates in crypto/x509crates.io1 CVE in this window
  12. 1257crypto/x509Worst: CVE-2026-111943 · Go standard library crypto/x509 · stdlib +3: Distrust compromised intermediate certificates in crypto/x509Go1 CVE in this window
  13. 1357stdlibWorst: CVE-2026-111943 · Go standard library crypto/x509 · stdlib +3: Distrust compromised intermediate certificates in crypto/x509Go1 CVE in this window
  14. 1457lmcacheWorst: CVE-2026-105192 · LMCache: Unauthenticated RCE in multiprocess pickle decodingPyPI1 CVE in this window
  15. 1555@enspirit/eloWorst: CVE-2026-44267 · enspirit elo · @enspirit/elo: Sandbox escape to code execution in JavaScript emitternpm3 CVEs in this window
  16. 1652PoauthlibWorst: CVE-2026-49272 · oauthlib: Auth bypass in device flow token endpointPyPI1 CVE in this window
  17. 1750github.com/kyverno/kyvernoWorst: CVE-2026-54523 · kyverno · github.com/kyverno/kyverno: Privilege escalation in NamespacedMutatingPolicyGo1 CVE in this window
  18. 1850P@graphql-tools/utilsWorst: CVE-2026-114604 · ardatan graphql-tools · @graphql-tools/utils: GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segmentsnpm1 CVE in this window
  19. 1946Psnowflake-connector-pythonWorst: CVE-2026-123859 · snowflake-connector-python: SQL injection in write_pandas column namesPyPI1 CVE in this window
  20. 2045arrowWorst: CVE-2026-111959 · Apache Software Foundation arrow · arrow-data: Out-of-bounds read in run-end encoded arrayscrates.io1 CVE in this window
  21. 2145arrow-dataWorst: CVE-2026-111959 · Apache Software Foundation arrow · arrow-data: Out-of-bounds read in run-end encoded arrayscrates.io1 CVE in this window
  22. 2245org.apache.mina:mina-coreWorst: CVE-2026-118636 · Apache Software Foundation org.apache.mina:mina-core: Arbitrary code execution in JavaNativeMessageDecoderMaven1 CVE in this window
  23. 2345org.apache.syncope.core:syncope-core-persistence-jpaWorst: CVE-2026-114364 · Apache Software Foundation org.apache.syncope.core:syncope-…: SQL injection in audit events searchMaven1 CVE in this window
  24. 2444Porg.apache.zookeeper:zookeeperWorst: CVE-2026-115448 · Apache Software Foundation org.apache.zookeeper:zookeeper: Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverableMaven4 CVEs in this window
  25. 2543org.apache.jclouds:jclouds-coreWorst: CVE-2026-119724 · Apache Software Foundation org.apache.jclouds:jclouds-core: Denial of service in XML provider-response parsingMaven1 CVE in this window
  26. 2640org.apache.wicket:wicket-coreWorst: CVE-2026-84170 · Apache Software Foundation org.apache.wicket:wicket-core: Denial of service in standalone file upload resourceMaven7 CVEs in this window
  27. 2740Porg.apache.juneau:juneau-marshallWorst: CVE-2026-73098 · Apache Software Foundation org.apache.juneau:juneau-marshall: Unsafe class initialization in parserMaven3 CVEs in this window
  28. 2840Porg.apache.juneau:juneau-rest-server.Worst: CVE-2026-73099 · Apache Software Foundation org.apache.juneau:juneau-rest-se…: Cross-site request forgery via content query parameterMaven2 CVEs in this window
  29. 2940org.apache.syncope.core:syncope-core-springWorst: CVE-2026-113687 · Apache Software Foundation org.apache.syncope.core:syncope-…: Remote code execution through Groovy sandbox bypassMaven1 CVE in this window
  30. 3040org.apache.syncope.core.idrepo:syncope-core-idrepo-logicWorst: CVE-2026-113511 · Apache Software Foundation org.apache.syncope.core.idrepo:s…: Access control bypass in realm updatesMaven1 CVE in this window
  31. 3140org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmnWorst: CVE-2026-109083 · Apache Software Foundation org.apache.syncope.ext.flowable:…: Remote code execution via JUEL expressions in workflowsMaven1 CVE in this window
  32. 3240org.apache.thrift:libthriftWorst: CVE-2026-120135 · Apache Software Foundation org.apache.thrift:libthrift: Denial of service in Java TProtocolUtil.skip() recursionMaven1 CVE in this window
  33. 3339Porg.apache.juneau:juneau-rest-serverWorst: CVE-2026-73095 · Apache Software Foundation org.apache.juneau:juneau-marshal…: Apache Juneau: Denial of service via unbounded memory allocation in parsers and REST request handlingMaven3 CVEs in this window
  34. 3439@angular/routerWorst: CVE-2026-111751 · angular · @angular/router: Denial of service via query parameters in RouterLink SSRnpm1 CVE in this window
  35. 3538org.geonetwork-opensource:geonetworkWorst: CVE-2026-46487 · core-geonetwork · org.geonetwork-opensource:geonetwork: Access control bypass in Elasticsearch searchMaven1 CVE in this window
  36. 3638PdcmjsWorst: CVE-2026-46350 · dcmjs-org dcmjs · dcmjs: INPUT validation BYPASS in DS/IS numeric parsingnpm1 CVE in this window
  37. 3737Porg.apache.juneau:juneau-rest-commonWorst: CVE-2026-73116 · Apache Software Foundation org.apache.juneau:juneau-rest-cl…: Credential leak via cross-origin redirects in REST clientMaven2 CVEs in this window
  38. 3837Porg.apache.juneau:juneau-commonsWorst: CVE-2026-121489 · Apache Software Foundation org.apache.juneau:juneau-microse…: Path traversal in DirectoryResource exposes filesMaven1 CVE in this window
  39. 3937Porg.apache.juneau:juneau-microservice-coreWorst: CVE-2026-121489 · Apache Software Foundation org.apache.juneau:juneau-microse…: Path traversal in DirectoryResource exposes filesMaven1 CVE in this window
  40. 4037Porg.apache.juneau:juneau-rest-clientWorst: CVE-2026-73116 · Apache Software Foundation org.apache.juneau:juneau-rest-cl…: Credential leak via cross-origin redirects in REST clientMaven1 CVE in this window
  41. 4137PblackWorst: CVE-2026-114134 · psf black · black: Remote code execution in GitHub Action via pyproject.tomlPyPI1 CVE in this window
  42. 4237PrucioWorst: CVE-2026-58273 · rucio: Authorisation bypass in URL-signing REST APIPyPI1 CVE in this window
  43. 4336Porg.apache.james:james-serverWorst: CVE-2026-85111 · Apache Software Foundation Apache James · Apache Software F…: Denial of service in MIME message parsingMaven1 CVE in this window
  44. 4435Pio.github.jopenlibs:vault-java-driverWorst: CVE-2026-109408 · io.github.jopenlibs:vault-java-driver: vault-java-driver: SslConfig silently disables requested TLS verificationMaven1 CVE in this window
  45. 4532github.com/chainguard-dev/kanikoWorst: CVE-2026-105769 · chainguard kaniko · github.com/chainguard-dev/kaniko: Access token leak to lookalike ACR hostsGo1 CVE in this window
  46. 4630org.apache.wicket:wicket-extensionsWorst: CVE-2026-83539 · Apache Software Foundation org.apache.wicket:wicket-extensi…: Cross-site scripting in SmartLinkLabelMaven1 CVE in this window
  47. 4728go.temporal.io/serverWorst: CVE-2026-120091 · Temporal Technologies go.temporal.io/server: Temporal Server Kubernetes compute provider builds a client from caller-supplied configuration and runs a caller-chosen command on the…Go1 CVE in this window
  48. 4828org.apache.syncope.core.am:syncope-core-am-logicWorst: CVE-2026-110535 · Apache Software Foundation org.apache.syncope.core.am:synco…: Privilege escalation via self-service AuthProfile updateMaven1 CVE in this window
  49. 4927PgeonodeWorst: CVE-2026-33050 · geonode: Command execution in layer name handling of uploaded filesPyPI1 CVE in this window
  50. 5026org.apache.wicket:wicket-auth-rolesWorst: CVE-2026-82840 · Apache Software Foundation org.apache.wicket:wicket-auth-ro…: Session fixation in AuthenticatedWebSession re-loginMaven1 CVE in this window

Do you depend on one of these? Scan your lockfile.