Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-100689GitPython before 3.1.62 Path Traversal via gitmodules pathPyPI · gitpython · fixed in 3.1.62
- CVE-2026-100653vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin PropagationPyPI · vllm · fixed in 0.28.0
- CVE-2026-100652vLLM 0.22.0 through 0.23.0 Denial of Service via stop_token_idsPyPI · vllm · fixed in 0.24.0
- CVE-2026-100650vLLM before 0.29.0 Resource Exhaustion via Unbounded Media MaterializationPyPI · vllm · fixed in 0.30.0
- CVE-2026-57443SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email DigestsPyPI · scbe-aethermoore · fixed in 4.2.1
- CVE-2026-96749Heap out-of-bounds write via signed size overflow in BSON document encodingPyPI · pymongo · fixed in 4.18.2
- CVE-2026-96748Connection redirection via percent-encoded delimiter injection in connection string hostsPyPI · pymongo · fixed in 4.18.2
- CVE-2026-96747Forced local Unix socket connection via dot-sock KMS endpoint in client-side field encryptionPyPI · pymongo · fixed in 4.18.2
- CVE-2026-61732Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM contextPyPI · decepticon, decepticon-core +1 · fixed in 1.1.17
- CVE-2026-57179social-auth-core has a Session Fixation issuePyPI · social-auth-core · fixed in 5.0.0
- CVE-2026-57178social-auth-core: VK App backend accepts unsigned callback data when auth_key is missingPyPI · social-auth-core · fixed in 5.0.0
- CVE-2026-57177social-auth-core has Login CSRF via Missing State Parameter in LoginRadius BackendPyPI · social-auth-core · fixed in 5.0.0
- CVE-2026-57176social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend BackendPyPI · social-auth-core · fixed in 5.0.0
- CVE-2026-57175social-auth-core has an Improper Authentication issuePyPI · social-auth-core · fixed in 5.0.0
- CVE-2026-59980hpack: Unbounded variable integer decoding can cause run-away computation on malformed inputPyPI · hpack · fixed in 4.2.0
- CVE-2026-93421Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting EndpointPyPI · mesop · fixed in 1.3.4
- CVE-2026-92164Streamlink: HTTPSession follows HTTP redirects into file:// URLs, reading local filesPyPI · streamlink · fixed in 8.6.0
- CVE-2026-57576plone.app.dexterity and plone.app.contenttypes have a Denial of Service due to excessive title or description lengthPyPI · plone-app-dexterity · fixed in 5.0.1, 4.1.3, 3.2.3
- CVE-2026-62364wlc may disclose API tokens to project-configured URLsPyPI · wlc · fixed in 2.0.1
- CVE-2026-61570MPXJ: XXE Vulnerability in MerlinReaderPyPI · mpxj · fixed in 16.4.1
- CVE-2026-65829MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readersPyPI · mpxj · fixed in 16.5.0
- CVE-2026-83805Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobsPyPI · nautobot · fixed in 3.1.8
- CVE-2026-83801Nautobot: Stored cross-site scripting (XSS) in object create/edit form help textPyPI · nautobot · fixed in 2.4.37, 3.1.8
- CVE-2026-59991psd-tools: Uncontrolled memory allocation in psd-tools composite/numpy via crafted PSD geometryPyPI · psd-tools · fixed in 1.17.4
- CVE-2026-91129Home Assistant: mDNS Server-Side Request ForgeryPyPI · homeassistant · fixed in 2026.2.3
- CVE-2026-91130Home Assistant: XSS in Statistics Graph CardPyPI · homeassistant · fixed in 2026.7.0
- CVE-2026-57149plone.app.portlets Vulnerable to Remote Code Execution via TALES InjectionPyPI · plone-app-portlets · fixed in 5.0.8, 6.0.4, 7.0.2
- CVE-2026-77246MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload PathPyPI · mcp-atlassian · fixed in 0.22.0
- CVE-2026-77248MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transportPyPI · mcp-atlassian · fixed in 0.22.0
- CVE-2026-77249MCP Atlassian: Incomplete fix for CVE-2026-27826: redirect-based SSRF via unhooked requests session in Jira user-permission lookupPyPI · mcp-atlassian · fixed in 0.22.0