Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-81719openssl_encrypt before 1.4.9 Remote Code Execution via PluginPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81717openssl_encrypt before 1.4.9 Integrity Bypass via Added FilesPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81716openssl_encrypt before 1.4.9 Plugin Sandbox Path TraversalPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81715openssl_encrypt before 1.4.9 Credential Exposure via Debug OutputPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81714openssl_encrypt before 1.4.9 Plugin Signing Trust Anchor Enrollment BypassPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81706openssl_encrypt before 1.4.9 Key Substitution via Identity ShadowingPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81705openssl-encrypt before 1.4.9 Password Cleartext Leak via DebugPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81704openssl_encrypt before 1.4.9 Weak Key Derivation via D-BusPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81703openssl_encrypt before 1.4.9 Authentication Bypass via Unencrypted PQC KeyPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81702openssl_encrypt before 1.4.9 Key Substitution via Identity LoadPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81701openssl_encrypt before 1.4.9 Arbitrary Code Execution via unsigned pluginPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81700openssl_encrypt before 1.4.9 GPG Signature Verification BypassPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81699openssl_encrypt before 1.4.9 Denial of Service via unbounded KDF costPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81698openssl_encrypt before 1.4.9 Shell Injection via info commandPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81696openssl_encrypt before 1.4.9 Terminal Injection via info CommandPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81695openssl_encrypt before 1.4.9 Terminal Injection via key_idPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81694openssl-encrypt before 1.4.9 Output Injection via Unsanitized Filenames in verify-usb CommandPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81693openssl_encrypt before 1.4.9 Denial of Service via QR total fieldPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81691openssl_encrypt before 1.4.9 Credential Leakage via Unvalidated Server URLsPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81690verify-usb before 1.4.9 Symlink Directory Traversal Code ExecutionPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81689openssl_encrypt before 1.4.9 Weak Pepper Key DerivationPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81688openssl_encrypt before 1.4.9 Plaintext Confirmation Oracle via SHA-256PyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81686openssl_encrypt before 1.4.9 D-Bus Properties Authorization BypassPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81685openssl_encrypt before 1.4.9 Text Injection via Recovery Slot MetadataPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81684openssl_encrypt before 1.4.9 Information Disclosure via Command LinePyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81683openssl_encrypt before 1.4.9 Plaintext Private Key StoragePyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81681openssl_encrypt before 1.4.9 False Encryption via Cleartext StoragePyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81680openssl_encrypt before 1.4.9 Authentication Bypass via Recovery Slot RemovalPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-37004BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arPyPI · litellm · fixed in 1.83.7
- CVE-2026-55228Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorized read access to any private projectPyPI · weblate · fixed in 2026.7