Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-71211mlflow - Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy EndpointPyPI · mlflow
- CVE-2026-70494Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolderPyPI · open-webui · fixed in 0.11.0
- CVE-2026-70493Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophicallyPyPI · open-webui · fixed in 0.11.0
- CVE-2026-70492Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messagesPyPI · open-webui · fixed in 0.11.0
- CVE-2026-70491Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpointsPyPI · open-webui · fixed in 0.11.0
- CVE-2026-70490Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role checkPyPI · open-webui · fixed in 0.11.0
- CVE-2026-70489Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsingPyPI · open-webui · fixed in 0.11.0
- CVE-2026-54020Open WebUI: DNS Rebinding SSRF BypassPyPI · open-webui · fixed in 0.11.0
- CVE-2026-70488Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanupPyPI · open-webui · fixed in 0.11.0
- CVE-2026-70487Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadataPyPI · open-webui · fixed in 0.11.0
- CVE-2026-70486Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-originPyPI · open-webui · fixed in 0.11.0
- CVE-2026-70485Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLsPyPI · open-webui · fixed in 0.11.0
- CVE-2026-70484Open WebUI: Users denied the image-generation permission can still generate images via chat completionsPyPI · open-webui · fixed in 0.11.0
- CVE-2026-70483Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpointPyPI · open-webui · fixed in 0.11.0
- CVE-2026-70482Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any clientPyPI · open-webui · fixed in 0.11.0
- CVE-2026-70481Open WebUI: Any member with write access to a standard channel can edit or delete other members' messagesPyPI · open-webui · fixed in 0.11.0
- CVE-2026-70480Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart renderingPyPI · open-webui · fixed in 0.11.0
- CVE-2026-70479Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loaderPyPI · open-webui · fixed in 0.11.0
- CVE-2026-47781pdm: Project-Controlled `.pdm-plugins` Content Executes Before CLI ParsingPyPI · pdm · fixed in 2.27.0
- CVE-2026-47764pdm: Path traversal in wheel installation via overridden write_to_fsPyPI · pdm · fixed in 2.27.0
- CVE-2026-47763pdm: Project-Local State and Config Writes Follow SymlinksPyPI · pdm · fixed in 2.27.0
- CVE-2026-15830Potential denial-of-service vulnerability via nested geometry collectionsPyPI · django · fixed in 5.2.17, 6.0.8, 6.1.1
- CVE-2026-15307Server-side file-write and request forgery via spatial lookupsPyPI · django · fixed in 5.2.17, 6.0.8
- CVE-2026-69249python-cryptography: Duplicate self-signed intermediates can cause exponential path-buildingPyPI · cryptography · fixed in 49.0.0
- CVE-2026-69248python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtreesPyPI · cryptography · fixed in 49.0.0
- CVE-2026-69247cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timingPyPI · cryptography · fixed in 50.0.0
- CVE-2026-69244AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)PyPI · aiohttp · fixed in 3.14.3
- CVE-2026-48061Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host headerPyPI · litestar · fixed in 2.22.0
- CVE-2026-69243AIOHTTP: HTTP request smuggling via WebSocket upgradePyPI · aiohttp · fixed in 3.14.2
- CVE-2026-66065Ouroboros: Untrusted project .env can still reach RCE via omitted execution-routing keys (Incomplete fix of CVE-2026-47211)PyPI · ouroboros-ai · fixed in 0.42.1