Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-74883openssl_encrypt before 1.4.0 Sandbox Bypass via pathlib and ioPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74882openssl_encrypt before 1.4.0 Insecure Default ConfigurationPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74881openssl_encrypt before 1.4.0 CORS Misconfiguration via Wildcard OriginsPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74880openssl_encrypt before 1.4.0 Token Leakage via Query ParametersPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74879openssl_encrypt before 1.4.0 Information Disclosure via /ready endpointPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74878openssl_encrypt before 1.4.0 TOTP Rate Limiter BypassPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74877openssl_encrypt before 1.4.0 Missing Ownership Verification via revoke_keyPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74876openssl_encrypt before 1.4.0 Unverified Key Bundle EncryptionPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74875openssl_encrypt before 1.4.0 Schema Validation BypassPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74874openssl_encrypt before 1.4.0 Weak PRNG Steganography Pixel SelectionPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74873openssl_encrypt before 1.4.0 Password Exposure via CLI ArgumentPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74872openssl_encrypt before 1.4.0 Arbitrary Code Execution via WhirlpoolPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74871openssl_encrypt before 1.4.6 KDF Bypass via Sequential-XORPyPI · openssl-encrypt · fixed in 1.4.6
- CVE-2026-74870openssl_encrypt before 1.4.8 Hardware Pepper Information DisclosurePyPI · openssl-encrypt · fixed in 1.4.7
- CVE-2026-50027mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/DeletePyPI · mcp-memory-service · fixed in 10.67.1
- CVE-2026-47192kas's late signature validation may allow unnoticed repository manipulationsPyPI · kas · fixed in 5.3
- CVE-2026-47191kas checks out SHA-like git branches as valid commitsPyPI · kas · fixed in 5.3
- CVE-2026-49986Cortex has Untrusted Project Bootstrap Code Execution via `CLAUDE_PROJECT_DIR`PyPI · neuro-cortex-memory · fixed in 3.18.0
- CVE-2026-46380compliance-trestle Vulnerable to SSRF in Remote Fetching SubsystemPyPI · compliance-trestle · fixed in 3.12.2, 4.0.3
- CVE-2026-46439compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)PyPI · compliance-trestle · fixed in 3.12.2, 4.0.3
- CVE-2026-73417JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)PyPI · jupyterlab · fixed in 4.5.10, 4.6.2
- CVE-2026-73416jupyterlab: PyPI extension blocklist package-name canonicalization bypassPyPI · jupyterlab · fixed in 4.6.2, 4.5.10
- CVE-2026-45774compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path TraversalPyPI · compliance-trestle · fixed in 3.12.2, 4.0.3
- CVE-2026-45725compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path TraversalPyPI · compliance-trestle · fixed in 3.12.2, 4.0.3
- CVE-2026-48099WsgiDAV encoded dot segments can escape filesystem share rootsPyPI · wsgidav · fixed in 4.3.4
- CVE-2026-59714Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)PyPI · open-webui · fixed in 0.10.0
- CVE-2026-73652vantage6: Algorithm developer can edit another developer's algorithm that is pending / under reviewPyPI · vantage6
- CVE-2026-73568py-libp2p: yamux connection DoS via oversized data framePyPI · libp2p
- CVE-2026-73559vLLM: Completion prompt lists fan out into unbounded engine requestsPyPI · vllm · fixed in 0.26.0
- CVE-2026-73558vLLM: Cross-User Data Leak VulnerabilityPyPI · vllm · fixed in 0.27.0