Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-76219GitPython before 3.1.58 Arbitrary File Overwrite via read-treePyPI · gitpython · fixed in 3.1.58
- CVE-2026-76218GitPython before 3.1.58 Remote Code Execution via Repo.initPyPI · gitpython · fixed in 3.1.58
- CVE-2026-76217GitPython before 3.1.58 Arbitrary File Read via pathspec-from-filePyPI · gitpython · fixed in 3.1.58
- CVE-2026-73974linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE)PyPI · linuxfabrik-lib · fixed in 6.1.0
- CVE-2026-55426linuxfabrik-lib: Local privilege escalation using embedded commandPyPI · linuxfabrik-lib · fixed in 5.0.0
- CVE-2026-53759linuxfabrik-lib: Insecure creation of SQLite databasesPyPI · linuxfabrik-lib · fixed in 4.2.0
- CVE-2026-52817Linuxfabrik Monitoring Plugins Sudoers: /usr/bin/apt-get arguments allow privilege escalationPyPI · linuxfabrik-lib · fixed in 5.1.0
- CVE-2026-71417Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking itPyPI · lemur · fixed in 1.9.3
- CVE-2026-71322Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = FalsePyPI · lemur · fixed in 1.9.3
- CVE-2026-71317Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authorityPyPI · lemur · fixed in 1.9.3
- CVE-2026-70666Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLsPyPI · lemur · fixed in 1.9.3
- CVE-2026-71303Lemur: Incomplete fix for CVE-2026-55166 -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlistPyPI · lemur · fixed in 1.9.3
- CVE-2026-71307Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations APIPyPI · lemur · fixed in 1.9.3
- CVE-2026-71308Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificatesPyPI · lemur · fixed in 1.9.3
- CVE-2026-70667Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for CVE-2026-55162)PyPI · lemur · fixed in 1.9.3
- CVE-2026-55164Lemur: Plaintext password storage in Lemur user-update pathPyPI · lemur · fixed in 1.9.2
- CVE-2026-55162Lemur: Post-authentication SSRF via certificate verification - attacker-controlled CRL and OCSP URLs in uploaded certificatesPyPI · lemur · fixed in 1.9.2
- CVE-2026-55166Lemur: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acme_url SSRF and creator-equality IDORPyPI · lemur · fixed in 1.9.2
- CVE-2026-55163Lemur: Privilege escalation via PUT /api/1/roles/<id> — non-admin role members can rewrite role membershipPyPI · lemur · fixed in 1.9.2
- CVE-2026-55165Lemur : JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap; chain-dependent ATO with secret disclosurePyPI · lemur · fixed in 1.9.2
- CVE-2026-48508Lemur: Authorization bypass in StrictRolePermission / AuthorityCreatorPermissionPyPI · lemur · fixed in 1.9.1
- CVE-2026-49452WeasyPrint: CSS Injection via Presentational HintsPyPI · weasyprint
- CVE-2026-53533aiosmtplib: SMTP command injection via CR/LF in sender/recipient addressPyPI · aiosmtplib · fixed in 5.1.1
- CVE-2026-68923MobSF: CSRF checks not enforced after Django migrationPyPI · mobsf · fixed in 4.5.1
- CVE-2026-68927MobSF: SSRF port restriction bypass in assetlinks_checkPyPI · mobsf · fixed in 4.5.1
- CVE-2026-68922MobSF: Arbitrary File Read via Path Traversal in ZIP UploadsPyPI · mobsf · fixed in 4.5.1
- CVE-2026-68924MobSF: Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK ExtractionPyPI · mobsf · fixed in 4.5.1
- CVE-2026-54552sh _uid does not drop supplementary groups (incomplete privilege drop)PyPI · sh · fixed in 2.2.4
- CVE-2026-70657Copyparty: file/dirkey confusionPyPI · copyparty · fixed in 1.20.17
- CVE-2026-63632ONNX: Heap-Buffer-Overflow READ in Gemm Version Converter Adapter via Undersized Input ShapePyPI · onnx · fixed in 1.22.0