Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-64849MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)PyPI · mlflow · fixed in 3.15.0
- CVE-2026-73560vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protectionsPyPI · vllm · fixed in 0.26.0
- CVE-2026-71486vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output boundsPyPI · vllm · fixed in 0.26.0
- CVE-2026-48053Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewsetPyPI · kolibri · fixed in 0.19.4
- CVE-2026-46345compliance-trestle - jinja has an Arbitrary File Write via Path TraversalPyPI · compliance-trestle · fixed in 3.12.2, 4.0.3
- CVE-2026-54284sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps triggerPyPI · sqlparse · fixed in 0.6.0
- CVE-2026-59893sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)PyPI · sqlparse · fixed in 0.6.0
- CVE-2026-71491sqlparse: Quadratic O(n²) DoS in group_commentsPyPI · sqlparse · fixed in 0.6.0
- CVE-2026-59894sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashesPyPI · sqlparse · fixed in 0.6.0
- CVE-2026-68519Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)PyPI · glances · fixed in 4.5.6
- CVE-2026-62982Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injectionPyPI · glances · fixed in 4.5.6
- CVE-2026-68520Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/configPyPI · glances · fixed in 4.5.6
- CVE-2026-68517Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the WildcardPyPI · glances · fixed in 4.5.6
- CVE-2026-68518Glances: Command injection bypass of action-template sanitizer via cross-field shell-operator reconstructionPyPI · glances · fixed in 4.5.6
- CVE-2026-74901openssl_encrypt before 1.4.0 Authentication Bypass via AES-CTR FallbackPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74900openssl_encrypt before 1.4.0 Weak Shared Secret via PQC Simulation ModePyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74899openssl_encrypt before 1.4.0 Sandbox Escape via Type HierarchyPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74896openssl_encrypt before 1.4.0 Sandbox Escape via Dunder Attribute TraversalPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74895openssl_encrypt before 1.4.0 Plugin Sandbox Bypass via Process IsolationPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74894openssl_encrypt before 1.4.0 Authentication Bypass via Bearer TokenPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74893openssl_encrypt before 1.4.0 JWT Token Forgery via Hardcoded SecretsPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74892openssl_encrypt before 1.4.0 Hardcoded Secret KeyPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74891openssl_encrypt before 1.4.0 Hardcoded Database CredentialsPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74890openssl_encrypt before 1.4.0 HMAC Authentication Bypass via Environment VariablePyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74889openssl_encrypt before 1.4.0 Weak Key Derivation via HKDFPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74888openssl_encrypt before 1.4.0 Non-Standard PBKDF2 Key DerivationPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74887openssl_encrypt before 1.4.0 Insecure Random Import in PQC ModulePyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74886openssl_encrypt before 1.4.0 Plugin Import Guard BypassPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74885openssl_encrypt before 1.4.0 Logging Bug and Race ConditionPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74884openssl_encrypt before 1.4.0 Path Traversal via plugin_idPyPI · openssl-encrypt · fixed in 1.4.0