Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

Libraries recently hit by a critical vulnerability

Among the 200 most recent libraries with critical CVEs, those with confirmed usage are shown first using npm, Maven and PyPI data; libraries without a measurement are not excluded.

Updated : CVE List (cvelistV5) : NVD (fkie-cad mirror) : OSV.dev :

LibraryAffected versionsSeverityWeaknessCVEFixed in
mlflow PyPI 28 critical CVEs3.12.0rc0 – < 3.17.0CRITICAL 9.8CWE-94 Code Injection +1CVE-2026-116692
3.17.0
better-auth npm 7 critical CVEs1.4.0-beta.18 – < 1.7.7CRITICAL 9.1CWE-287 Improper AuthenticationCVE-2026-114607
1.7.7
brotli PyPI 2 critical CVEs1.0.3 – < 1.2.1CRITICAL 9.2 KEVCWE-787 Out-of-bounds Write +1CVE-2026-111497
1.2.1
brotlicffi PyPI1.0.3 – < 1.2.1.0CRITICAL 9.2 KEVCWE-787 Out-of-bounds Write +1CVE-2026-111497
1.2.1.0
mem0ai PyPI0.1.117 – < 1.0.8CRITICAL 9.2CWE-89 SQL InjectionCVE-2026-115324
1.0.8
pillow PyPI 16 critical CVEs11.0.0 – < 13.0.0CRITICAL 9.8CWE-125 Out-of-bounds Read +1CVE-2026-96639
13.0.0
@sentry/nextjs npm 2 critical CVEs9.36.0 – < 9.47.2 ; 10.0.0-alpha.0 – < 10.75.2 ; 11.0.0-alpha.0 – < 11.0.0-rc.1CRITICAL 9.1CWE-693 Protection Mechanism FailureCVE-2026-114139
9.47.2, 10.75.2, 11.0.0-rc.1
trigger.dev npm< 4.5.6CRITICAL 9.2CWE-653CVE-2026-114087
4.5.6
vllm PyPI 10 critical CVEs0.7.3 – < 0.31.0CRITICAL 9.2CWE-94 Code InjectionCVE-2026-114053
0.31.0
claude-agent-sdk PyPI< 0.2.121CRITICAL 9.2CWE-20 Improper Input Validation +2CVE-2026-96620
0.2.121
undici npm 6 critical CVEs4.0.0 – < 6.29.1 ; 7.0.0 – < 7.30.1 ; 8.0.0 – < 8.12.2CRITICAL 9.1CWE-295 Improper Certificate ValidationCVE-2026-109383
6.29.1, 7.30.1, 8.12.2
gitpython PyPI 6 critical CVEs3.1.30 – < 3.2.0CRITICAL 9.2CWE-88 Argument InjectionCVE-2026-110858
3.2.0
git-diff npm< 2.0.7CRITICAL 9.3CWE-78 OS Command InjectionCVE-2026-110634
2.0.7
@tanstack/react-start npm 2 critical CVEs1.143.12 – < 1.168.60CRITICAL 9.3CWE-79 Cross-site Scripting (XSS)CVE-2026-102989
1.168.60
@tanstack/solid-start npm 2 critical CVEs1.143.12 – < 1.168.57CRITICAL 9.3CWE-79 Cross-site Scripting (XSS)CVE-2026-102989
1.168.57
@tanstack/start-server-core npm 2 critical CVEs1.143.12 – < 1.169.39CRITICAL 9.3CWE-79 Cross-site Scripting (XSS)CVE-2026-102989
1.169.39
praisonaiagents PyPI 11 critical CVEs< 1.6.59CRITICAL 9.8CWE-306 Missing Authentication for Critical Function +1CVE-2026-57118
1.6.59
obsidian-tc npm< 1.3.1CRITICAL 9.9CWE-639 Authorization Bypass Through User-Controlled Key (IDOR) +1CVE-2026-77366
1.3.1
@tinacms/app npm< 2.5.14CRITICAL 9.3CWE-346 Origin Validation Error +2CVE-2026-108261
2.5.14
tinacms npm< 3.14.0CRITICAL 9.3CWE-346 Origin Validation Error +2CVE-2026-108261
3.14.0
com.hazelcast/hazelcast Maven 3 critical CVEs5.6.0 – < 5.7.0 ; 5.5.0 – < 5.7.0 ; < 5.7.0CRITICAL 9.3CWE-20 Improper Input ValidationCVE-2026-107726
5.7.0
fast-jwt npm 4 critical CVEs6.2.0 – < 6.3.0CRITICAL 9.8CWE-347 Improper Verification of Cryptographic SignatureCVE-2026-107722
6.3.0
org.asynchttpclient/async-http-client Maven 2 critical CVEs3.0.0 – < 3.0.13 ; 2.0.0 – < 2.16.1CRITICAL 9.4CWE-319 Cleartext Transmission of Sensitive Information +2CVE-2026-107282
3.0.13, 2.16.1
@backstage/plugin-scaffolder-backend npm 3 critical CVEs< 3.3.1 ; 3.4.0 – < 3.4.1 ; 4.0.0 – < 4.0.3 ; …CRITICAL 9.6CWE-200 Exposure of Sensitive Information to an Unauthorized Actor +1CVE-2026-106501
3.3.1, 3.4.1, 4.0.3, 4.1.0
@backstage/plugin-scaffolder-backend-module-bitbucket-cloud npm< 0.3.10CRITICAL 9.9CWE-22 Path Traversal +1CVE-2026-106486
0.3.10
@backstage/plugin-scaffolder-backend-module-bitbucket-server npm< 0.2.25CRITICAL 9.9CWE-22 Path Traversal +1CVE-2026-106486
0.2.25
handlebars npm 6 critical CVEs4.0.0 – < 4.7.10CRITICAL 9.8CWE-94 Code Injection +1CVE-2026-106446
4.7.10
quasar npm< 2.22.0CRITICAL 10.0CWE-79 Cross-site Scripting (XSS) +1CVE-2026-106102
2.22.0
payload npm 5 critical CVEs3.0.0 – < 3.90.0 ; 4.0.0-canary.0 – < 4.0.0-canary.34CRITICAL 9.2CWE-290 Authentication Bypass by Spoofing +1CVE-2026-105863
3.90.0, 4.0.0-canary.34
@payloadcms/plugin-form-builder npm< 3.90.0 ; 4.0.0-canary.0 – < 4.0.0-canary.34CRITICAL 10.0CWE-94 Code Injection +1CVE-2026-105857
3.90.0, 4.0.0-canary.34
@payloadcms/plugin-import-export npm3.0.0 – < 3.88.0 ; 4.0.0-canary.0 – < 4.0.0-canary.27CRITICAL 9.3CWE-1321 Improperly Controlled Modification of Object Prototype (Prototype Pollution)CVE-2026-105844
3.88.0, 4.0.0-canary.27
tinypool npm 2 critical CVEs< 2.1.2CRITICAL 9.5CWE-94 Code Injection +1CVE-2026-104849
2.1.2
seroval npm 3 critical CVEs0.12.0 – < 1.6.2CRITICAL 9.8CWE-843 Type Confusion (Access of Resource Using Incompatible Type)CVE-2026-104846
1.6.2
@capacitor/android npm6.0.0 – < 6.2.2 ; 7.0.0 – < 7.6.9 ; 8.5.0 – < 8.5.1 ; …CRITICAL 9.3CWE-346 Origin Validation Error +1CVE-2026-103922
6.2.2, 7.6.9, 8.5.1, 8.4.3, ≤ 8.3.4, no fix
@capacitor/ios npm6.0.0 – < 6.2.2 ; 7.0.0 – < 7.6.9 ; 8.5.0 – < 8.5.1 ; …CRITICAL 9.3CWE-346 Origin Validation Error +1CVE-2026-103922
6.2.2, 7.6.9, 8.5.1, 8.4.3, ≤ 8.3.4, no fix
piscina npm5.0.0 – < 5.3.2 ; < 4.9.4 ; 6.0.0-rc.1 – < 6.0.0-rc.5CRITICAL 9.2CWE-1321 Improperly Controlled Modification of Object Prototype (Prototype Pollution)CVE-2026-102992
5.3.2, 4.9.4, 6.0.0-rc.5
@simple-git/argv-parser npm< 2.0.1CRITICAL 9.2CWE-78 OS Command Injection +1CVE-2026-102829
2.0.1
simple-git npm 8 critical CVEs3.15.0 – < 4.0.1CRITICAL 9.2CWE-78 OS Command Injection +1CVE-2026-102828
4.0.1
electron npm 9 critical CVEs< 41.10.6 ; 42.0.0-alpha.1 – < 42.9.2 ; 43.0.0-alpha.1 – < 43.4.1 ; …CRITICAL 9.8CWE-269 Improper Privilege Management +1CVE-2026-102676
41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5
shell-quote npm 4 critical CVEs1.8.4 – < 1.11.0CRITICAL 9.2CWE-78 OS Command InjectionCVE-2026-102422
1.11.0
pyjwt PyPI 3 critical CVEs< 2.14.0CRITICAL 9.1CWE-347 Improper Verification of Cryptographic SignatureCVE-2026-102268
2.14.0
authlib PyPI 2 critical CVEs< 1.9.0CRITICAL 9.8CWE-347 Improper Verification of Cryptographic Signature +3CVE-2026-96760
1.9.0
@xhmikosr/decompress npm 2 critical CVEs11.0.0 – < 11.1.4 ; < 10.2.2CRITICAL 9.1CWE-22 Path Traversal +1CVE-2026-101894
11.1.4, 10.2.2
decompress npm 3 critical CVEs≤ 4.2.1CRITICAL 9.1CWE-22 Path Traversal +1CVE-2026-101894
≤ 4.2.1, no fix
vm2 npm 52 critical CVEs< 3.12.2CRITICAL 9.5CWE-863 Incorrect AuthorizationCVE-2026-100721
3.12.2
@bytebase/dbhub npm< 0.22.5CRITICAL 9.3CWE-306 Missing Authentication for Critical Function +1CVE-2026-61742
0.22.5
io.moquette/moquette-broker Maven 2 critical CVEs< 0.18.1CRITICAL 9.3CWE-636CVE-2026-95848
0.18.1
suneditor npm< 2.47.11CRITICAL 10.0CWE-79 Cross-site Scripting (XSS)CVE-2026-59167
2.47.11
plone-app-portlets PyPI 2 critical CVEs7.0.0 – < 7.0.2 ; 6.0.0 – < 6.0.4 ; 5.0.0 – < 5.0.8CRITICAL 9.9CWE-95 Eval InjectionCVE-2026-57149
7.0.2, 6.0.4, 5.0.8
lightrag-hku PyPI 3 critical CVEs< 1.5.5CRITICAL 9.1CWE-307 Improper Restriction of Excessive Authentication AttemptsCVE-2026-85734
1.5.5
anyio PyPI< 4.14.2CRITICAL 9.3CWE-295 Improper Certificate Validation +1CVE-2026-63374
4.14.2
apache-airflow PyPI 17 critical CVEs3.0.0 – < 3.3.2CRITICAL 9.1CWE-613 Insufficient Session ExpirationCVE-2026-86473
3.3.2
org.xwiki.rendering/xwiki-rendering-xml Maven 2 critical CVEs< 14.10.2CRITICAL 9.9CWE-95 Eval InjectionCVE-2025-53837
14.10.2
@vendure/core npm 2 critical CVEs< 3.7.0CRITICAL 9.1CWE-287 Improper AuthenticationCVE-2026-63472
3.7.0
@zereight/mcp-gitlab npm 3 critical CVEs< 2.1.27CRITICAL 9.8CWE-22 Path TraversalCVE-2026-61560
2.1.27
dirac PyPI 3 critical CVEs6 – < 8.0.79 ; 8.1.0a1 – < 9.0.22 ; 9.1.0 – < 9.1.10CRITICAL 9.9CWE-89 SQL Injection +1CVE-2026-61667
8.0.79, 9.0.22, 9.1.10
tornado PyPI 2 critical CVEs< 6.4.1CRITICAL 9.0CWE-444 HTTP Request/Response SmugglingCVE-2024-14029
6.4.1
org.openidentityplatform.opendj/opendj-server-legacy Maven 2 critical CVEs< 5.1.1CRITICAL 9.2CWE-502 Deserialization of Untrusted DataCVE-2026-46495
5.1.1
org.openidentityplatform.openam/openam-core Maven< 16.1.2CRITICAL 9.8CWE-94 Code Injection +1CVE-2026-62379
16.1.2
proxy-addr npm1.1.0 – < 2.0.8CRITICAL 9.1CWE-290 Authentication Bypass by Spoofing +2CVE-2026-90711
2.0.8
uefi-firmware PyPI 2 critical CVEs≤ 1.12CRITICAL 9.8CWE-787 Out-of-bounds WriteCVE-2026-54334
≤ 1.12, no fix
resdata PyPI< 6.2.9CRITICAL 9.8CWE-120 Buffer Copy without Checking Size (Classic Buffer Overflow) +3CVE-2026-55209
6.2.9
yayson npm< 4.3.0CRITICAL 9.1CWE-1321 Improperly Controlled Modification of Object Prototype (Prototype Pollution)CVE-2026-61534
4.3.0
omniroute npm≤ 3.8.50CRITICAL 9.5CWE-94 Code Injection +1CVE-2026-88062
≤ 3.8.50, no fix
org.freemarker/freemarker Maven2.2.0 – < 2.3.35CRITICAL 9.1CWE-23CVE-2026-84939
2.3.35
@deepseek-ai/dsh-client-connection npm< 0.1.2-alpha.1CRITICAL 9.4CWE-807CVE-2026-82533
0.1.2-alpha.1
@sap/cds-mtxs npm4.0.1 – < 4.0.3 ; 3.0.1 – < 3.9.7 ; 2.0.2 – < 2.7.7 ; …CRITICAL 9.4CWE-522 Insufficiently Protected CredentialsCVE-2026-76969
4.0.3, 3.9.7, 2.7.7, 1.18.4
maplibre-gl npm< 6.4.1CRITICAL 10.0CWE-79 Cross-site Scripting (XSS)CVE-2026-85061
6.4.1
python-jose PyPI 2 critical CVEs≤ 3.5.0CRITICAL 9.3CWE-347 Improper Verification of Cryptographic SignatureCVE-2026-85394
≤ 3.5.0, no fix
next npm 2 critical CVEs13.4.0 – < 15.5.24 ; 16.0.0 – < 16.3.3CRITICAL 9.0CWE-22 Path TraversalCVE-2026-75604
15.5.24, 16.3.3
nodemailer npm 2 critical CVEs< 8.0.4CRITICAL 9.3CWE-93 CRLF InjectionCVE-2026-82854
8.0.4
github.com/labstack/echo/v4 Go 2 critical CVEs4.0.0 – < 4.16.1CRITICAL 9.1CWE-444 HTTP Request/Response Smuggling +1CVE-2026-118264
4.16.1
github.com/labstack/echo/v5 Go5.0.0 – < 5.4.1CRITICAL 9.1CWE-444 HTTP Request/Response Smuggling +1CVE-2026-118264
5.4.1
com.xwiki.pro/xwiki-pro-macros Maven1.13 – < 1.14.5CRITICAL 9.9CWE-95 Eval InjectionCVE-2026-44179
1.14.5
praisonai PyPI 32 critical CVEs4.2.1 – < 4.6.59CRITICAL 9.8CWE-200 Exposure of Sensitive Information to an Unauthorized Actor +2CVE-2026-57116
4.6.59
github.com/bytebase/bytebase Go< 1.0.1CRITICAL 9.3CWE-290 Authentication Bypass by SpoofingCVE-2022-51026
1.0.1
litellm PyPI 8 critical CVEs1.91.0 – < 1.100.4 ; 1.101.0 – < 1.101.3 ; 1.102.0 – < 1.102.2 ; …CRITICAL 9.9CWE-269 Improper Privilege Management +2CVE-2026-114612
1.100.4, 1.101.3, 1.102.2, 1.103.1, 1.104.0rc2
laravel/framework Packagist13.0.0 – < 13.29.0 ; < 12.68.0CRITICAL 9.2CWE-287 Improper Authentication +1CVE-2026-114509
13.29.0, 12.68.0
vibe-trading-ai PyPI0.1.0 – < 0.1.7CRITICAL 9.3CWE-306 Missing Authentication for Critical FunctionCVE-2026-114108
0.1.7
mercury PyPI 2 critical CVEs< 3.2.6CRITICAL 9.8CWE-862 Missing AuthorizationCVE-2026-111058
3.2.6
netlicensing-mcp PyPI< 0.1.8CRITICAL 9.6CWE-22 Path TraversalCVE-2026-57496
0.1.8
github.com/dgraph-io/dgraph/v25 Go 7 critical CVEs< 25.4.0CRITICAL 9.2CWE-306 Missing Authentication for Critical Function +1CVE-2026-102748
25.4.0
github.com/kedacore/keda Go≤ 1.5.0CRITICAL 9.9CWE-269 Improper Privilege Management +1CVE-2026-77524
≤ 1.5.0, no fix
github.com/kedacore/keda/v2 Go< 2.21.0CRITICAL 9.9CWE-269 Improper Privilege Management +1CVE-2026-77524
2.21.0
vitess.io/vitess Go 2 critical CVEs< 0.23.5 ; 0.24.0 – < 0.24.2CRITICAL 9.8CWE-79 Cross-site Scripting (XSS)CVE-2026-104252
0.23.5, 0.24.2
microsoft.native.quic.msquic.schannel NuGet 2 critical CVEs2.5.11-ci.156755675 – < 2.5.11-ci.159417053CRITICAL 9.8CWE-122 Heap-based Buffer OverflowCVE-2026-105016
2.5.11-ci.159417053
microsoft.aspnetcore.app.runtime.linux-arm NuGet 3 critical CVEs8.0.0 – < 8.0.32 ; 10.0.0 – < 10.0.13 ; 11.0.0-preview.1 – < 11.0.0-rc.2 ; …CRITICAL 9.4CWE-444 HTTP Request/Response SmugglingCVE-2026-88092
8.0.32, 10.0.13, 11.0.0-rc.2, 9.0.21
microsoft.aspnetcore.app.runtime.linux-arm64 NuGet 3 critical CVEs8.0.0 – < 8.0.32 ; 10.0.0 – < 10.0.13 ; 11.0.0-preview.1 – < 11.0.0-rc.2 ; …CRITICAL 9.4CWE-444 HTTP Request/Response SmugglingCVE-2026-88092
8.0.32, 10.0.13, 11.0.0-rc.2, 9.0.21
microsoft.aspnetcore.app.runtime.linux-musl-arm NuGet 3 critical CVEs8.0.0 – < 8.0.32 ; 10.0.0 – < 10.0.13 ; 11.0.0-preview.1 – < 11.0.0-rc.2 ; …CRITICAL 9.4CWE-444 HTTP Request/Response SmugglingCVE-2026-88092
8.0.32, 10.0.13, 11.0.0-rc.2, 9.0.21
microsoft.aspnetcore.app.runtime.linux-musl-arm64 NuGet 3 critical CVEs8.0.0 – < 8.0.32 ; 10.0.0 – < 10.0.13 ; 11.0.0-preview.1 – < 11.0.0-rc.2 ; …CRITICAL 9.4CWE-444 HTTP Request/Response SmugglingCVE-2026-88092
8.0.32, 10.0.13, 11.0.0-rc.2, 9.0.21
microsoft.aspnetcore.app.runtime.linux-musl-x64 NuGet 3 critical CVEs8.0.0 – < 8.0.32 ; 10.0.0 – < 10.0.13 ; 11.0.0-preview.1 – < 11.0.0-rc.2 ; …CRITICAL 9.4CWE-444 HTTP Request/Response SmugglingCVE-2026-88092
8.0.32, 10.0.13, 11.0.0-rc.2, 9.0.21
microsoft.aspnetcore.app.runtime.linux-x64 NuGet 3 critical CVEs8.0.0 – < 8.0.32 ; 10.0.0 – < 10.0.13 ; 11.0.0-preview.1 – < 11.0.0-rc.2 ; …CRITICAL 9.4CWE-444 HTTP Request/Response SmugglingCVE-2026-88092
8.0.32, 10.0.13, 11.0.0-rc.2, 9.0.21
microsoft.aspnetcore.app.runtime.osx-arm64 NuGet 3 critical CVEs8.0.0 – < 8.0.32 ; 10.0.0 – < 10.0.13 ; 11.0.0-preview.1 – < 11.0.0-rc.2 ; …CRITICAL 9.4CWE-444 HTTP Request/Response SmugglingCVE-2026-88092
8.0.32, 10.0.13, 11.0.0-rc.2, 9.0.21
microsoft.aspnetcore.app.runtime.osx-x64 NuGet 3 critical CVEs8.0.0 – < 8.0.32 ; 10.0.0 – < 10.0.13 ; 11.0.0-preview.1 – < 11.0.0-rc.2 ; …CRITICAL 9.4CWE-444 HTTP Request/Response SmugglingCVE-2026-88092
8.0.32, 10.0.13, 11.0.0-rc.2, 9.0.21
microsoft.aspnetcore.app.runtime.win-arm64 NuGet 3 critical CVEs8.0.0 – < 8.0.32 ; 10.0.0 – < 10.0.13 ; 11.0.0-preview.1 – < 11.0.0-rc.2 ; …CRITICAL 9.4CWE-444 HTTP Request/Response SmugglingCVE-2026-88092
8.0.32, 10.0.13, 11.0.0-rc.2, 9.0.21
microsoft.aspnetcore.app.runtime.win-x64 NuGet 3 critical CVEs8.0.0 – < 8.0.32 ; 10.0.0 – < 10.0.13 ; 11.0.0-preview.1 – < 11.0.0-rc.2 ; …CRITICAL 9.4CWE-444 HTTP Request/Response SmugglingCVE-2026-88092
8.0.32, 10.0.13, 11.0.0-rc.2, 9.0.21
microsoft.aspnetcore.app.runtime.win-x86 NuGet 3 critical CVEs8.0.0 – < 8.0.32 ; 10.0.0 – < 10.0.13 ; 11.0.0-preview.1 – < 11.0.0-rc.2 ; …CRITICAL 9.4CWE-444 HTTP Request/Response SmugglingCVE-2026-88092
8.0.32, 10.0.13, 11.0.0-rc.2, 9.0.21
github.com/containers/podman Go4.4.0 – < 5.8.8CRITICAL 10.0CWE-693 Protection Mechanism FailureCVE-2026-94603
5.8.8
go.podman.io/podman/v6 Go6.0.0 – < 6.1.3CRITICAL 10.0CWE-693 Protection Mechanism FailureCVE-2026-94603
6.1.3
github.com/containers/podman/v2 Go*CRITICAL 10.0CWE-693 Protection Mechanism FailureCVE-2026-94603
no fix published