Skip to main content
cve.nowby Sazabi
Rankings

Rankings: This month's worst packages

Open source packages ranked by the score of their worst CVE published or escalated in the window, then by how many they have. How the score works.

  1. 192github.com/andybalholm/brotliWorst: CVE-2026-111497 · Google Brotli · node +7: Out-of-bounds write in decompression decoderGo1 CVE in this window
  2. 292brotliWorst: CVE-2026-111497 · Google Brotli · node +7: Out-of-bounds write in decompression decoderPyPI1 CVE in this window
  3. 392brotlicffiWorst: CVE-2026-111497 · Google Brotli · node +7: Out-of-bounds write in decompression decoderPyPI1 CVE in this window
  4. 485code.gitea.io/giteaWorst: CVE-2026-60004 · Gitea · gitea.dev +1: Remote code execution in diffpatch API via Git hooksGo1 CVE in this window
  5. 585gitea.devWorst: CVE-2026-60004 · Gitea · gitea.dev +1: Remote code execution in diffpatch API via Git hooksGo1 CVE in this window
  6. 683gogs.io/gogsWorst: CVE-2025-8110 · Gogs · gogs.io/gogs: File overwrite in file update API via symlinksGo2 CVEs in this window
  7. 768node-forgeWorst: CVE-2026-118782 · digitalbazaar forge · node-forge: Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration countnpm5 CVEs in this window
  8. 868pyasn1Worst: CVE-2026-119196 · pyasn1: pyasn1: Quadratic CPU consumption in constructed BIT STRING decodingPyPI4 CVEs in this window
  9. 968org.openidentityplatform.openam:openamWorst: CVE-2026-33439 · OpenIdentityPlatform OpenAM · org.openidentityplatform.open…: Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAMMaven1 CVE in this window
  10. 1068joserfcWorst: CVE-2026-119283 · authlib joserfc · joserfc: joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key DecryptionPyPI1 CVE in this window
  11. 1166io.netty:netty-codec-http2Worst: CVE-2026-33871 · netty · io.netty:netty-codec-http2: Denial of service in HTTP/2 CONTINUATION handlingMaven1 CVE in this window
  12. 1265@graphql-tools/executor-legacy-wsWorst: CVE-2026-118665 · ardatan graphql-tools · @graphql-tools executor-legacy-ws +1: GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authenticationsnpm1 CVE in this window
  13. 1364pillowWorst: CVE-2026-112896 · python-pillow Pillow · pillow: Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds readPyPI26 CVEs in this window
  14. 1464gitpythonWorst: CVE-2026-110859 · gitpython-developers GitPython · gitpython: GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch NamePyPI6 CVEs in this window
  15. 1564nodemailerWorst: CVE-2026-110869 · nodemailer: Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexesnpm4 CVEs in this window
  16. 1664tomlWorst: CVE-2026-114143 · BinaryMuse toml-node · toml: toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()npm4 CVEs in this window
  17. 1764djangorestframeworkWorst: CVE-2026-114136 · encode django-rest-framework · djangorestframework: Django REST framework: JSONParser applies an attacker-named codec to the request streamPyPI3 CVEs in this window
  18. 1864adm-zipWorst: CVE-2026-114102 · cthackers adm-zip · adm-zip: adm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error Eventnpm2 CVEs in this window
  19. 1963graphql-coreWorst: CVE-2026-75508 · graphql-python graphql-core · graphql-core: GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limitPyPI3 CVEs in this window
  20. 2063markdown-itWorst: CVE-2026-111758 · markdown-it: markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)npm2 CVEs in this window
  21. 2163@hapi/joiWorst: CVE-2026-118772 · hapijs joi · @hapi joi +2: joi: quadratic-time split in `string().email({ multiple: true })` allows denial of servicenpm1 CVE in this window
  22. 2263joiWorst: CVE-2026-118772 · hapijs joi · @hapi joi +2: joi: quadratic-time split in `string().email({ multiple: true })` allows denial of servicenpm1 CVE in this window
  23. 2363payloadWorst: CVE-2026-105863 · payloadcms payload · payload: Payload authentication token field handling issuenpm1 CVE in this window
  24. 2462org.keycloak:keycloak-servicesWorst: CVE-2026-18963 · Red Hat build of Keycloak · Red Hat JBoss Enterprise App… +2: Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypassMaven1 CVE in this window
  25. 2562org.pac4j:pac4j-jwtWorst: CVE-2026-29000 · pac4j-jwt · org.pac4j:pac4j-jwt: Authentication bypass in JwtAuthenticatorMaven1 CVE in this window
  26. 2661zipWorst: CVE-2026-115905 · zip-rs zip2 · zip: zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File…crates.io4 CVEs in this window
  27. 2761fast-jwtWorst: CVE-2026-107722 · nearform fast-jwt · fast-jwt: fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusionnpm4 CVEs in this window
  28. 2861mlflowWorst: CVE-2026-116692 · mlflow: Remote code execution in scorer deserializationPyPI4 CVEs in this window
  29. 2960twistedWorst: CVE-2026-115775 · twisted: Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element TreePyPI4 CVEs in this window
  30. 3060authlibWorst: CVE-2026-114615 · authlib: Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keysPyPI3 CVEs in this window
  31. 3160follow-redirectsWorst: CVE-2026-111756 · follow-redirects: follow-redirects array-form headers bypass cross-origin credential strippingnpm2 CVEs in this window
  32. 3260org.apache.camel:camel-hazelcastWorst: CVE-2026-78162 · Apache Software Foundation org.apache.camel:camel-hazelcast: Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865)Maven1 CVE in this window
  33. 3360@angular/platform-serverWorst: CVE-2026-101895 · angular · @angular/ platform-server +1: Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPEnpm1 CVE in this window
  34. 3460cairosvgWorst: CVE-2026-107378 · Kozea CairoSVG · cairosvg: CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>PyPI1 CVE in this window
  35. 3560nltkWorst: CVE-2026-109956 · nltk: NLTK through 3.10.3 Path Traversal via WekaClassifier Model PathPyPI1 CVE in this window
  36. 3660rembgWorst: CVE-2026-115924 · danielgatis rembg · rembg: Rembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphsPyPI1 CVE in this window
  37. 3759@hapi/contentWorst: CVE-2026-119202 · hapijs content · @hapi/content +1: @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of servicenpm2 CVEs in this window
  38. 3859contentWorst: CVE-2026-119202 · hapijs content · @hapi/content +1: @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of servicenpm1 CVE in this window
  39. 3959graphql-scalarsWorst: CVE-2026-115887 · graphql-hive graphql-scalars · graphql-scalars: graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of servicenpm1 CVE in this window
  40. 4059datamodel-code-generatorWorst: CVE-2026-107377 · datamodel-code-generator: datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directoryPyPI1 CVE in this window
  41. 4159PmonaiWorst: CVE-2026-48705 · Project-MONAI MONAI · monai: Denial of service and data corruption in DICOM parsingPyPI1 CVE in this window
  42. 4259strawberry-graphqlWorst: CVE-2026-107728 · strawberry-graphql strawberry · strawberry-graphql: Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthyPyPI1 CVE in this window
  43. 4358trigger.devWorst: CVE-2026-114087 · triggerdotdev trigger.dev · trigger.dev: Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secretsnpm3 CVEs in this window
  44. 4458re2jsWorst: CVE-2026-116795 · le0pard re2js · re2js: RE2JS: Quadratic-time denial of service in re2js lookbehind matchingnpm1 CVE in this window
  45. 4557stdlibWorst: CVE-2026-111943 · Go standard library crypto/x509 · stdlib +3: Distrust compromised intermediate certificates in crypto/x509Go12 CVEs in this window
  46. 4657happy-domWorst: CVE-2026-115895 · capricorn86 happy-dom · happy-dom: Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code executionnpm2 CVEs in this window
  47. 4757rustls-webpkiWorst: CVE-2026-111943 · Go standard library crypto/x509 · stdlib +3: Distrust compromised intermediate certificates in crypto/x509crates.io1 CVE in this window
  48. 4857webpki-root-certsWorst: CVE-2026-111943 · Go standard library crypto/x509 · stdlib +3: Distrust compromised intermediate certificates in crypto/x509crates.io1 CVE in this window
  49. 4957webpki-rootsWorst: CVE-2026-111943 · Go standard library crypto/x509 · stdlib +3: Distrust compromised intermediate certificates in crypto/x509crates.io1 CVE in this window
  50. 5057crypto/x509Worst: CVE-2026-111943 · Go standard library crypto/x509 · stdlib +3: Distrust compromised intermediate certificates in crypto/x509Go1 CVE in this window

Do you depend on one of these? Scan your lockfile.