Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-47211Ouroboros: Remote Code Execution via Untrusted Project-Directory .envPyPI · ouroboros-ai · fixed in 0.39.0
- CVE-2026-18654Disabled SSH host key verification in Amazon AWS CLI EMR helper commandsPyPI · awscli · fixed in 1.45.28
- CVE-2026-69097GitPython before 3.1.53 Config Injection via Submodule NamesPyPI · gitpython · fixed in 3.1.53
- CVE-2026-12259Improper Input Validation in nltk/nltkPyPI · nltk · fixed in 3.9.3
- CVE-2026-9856Path Traversal in huggingface/transformersPyPI · transformers · fixed in 5.10.0
- CVE-2026-9335Improper Handling of HDF5 ExternalLinks in keras-team/kerasPyPI · keras · fixed in 3.12.3, 3.15.0
- CVE-2026-67326GitPython before 3.1.50 Newline Injection via config_writer sectionPyPI · gitpython · fixed in 3.1.50
- CVE-2026-67324GitPython 3.1.50 Authentication Bypass via Joined Short OptionsPyPI · gitpython · fixed in 3.1.51
- CVE-2026-67323GitPython before 3.1.51 Command Injection via unguarded Git optionsPyPI · gitpython · fixed in 3.1.51
- CVE-2026-67338JupyterLab before 4.5.9 Stored XSS via Extension ManagerPyPI · jupyterlab · fixed in 4.5.9
- CVE-2026-67322GitPython before 3.1.52 Environment Variable Exfiltration via clone_fromPyPI · gitpython · fixed in 3.1.52
- CVE-2026-67325GitPython before 3.1.51 Command Injection via option prefix abbreviationPyPI · gitpython · fixed in 3.1.51
- CVE-2026-54785gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline modePyPI · gemini-bridge · fixed in 1.3.1
- CVE-2026-68770sentence-transformers Arbitrary Code Execution on Local Model Load Despite trust_remote_code=FalsePyPI · sentence-transformers · fixed in 5.6.0
- CVE-2026-53502Thumbor has path traversal via post-validation URL decoding bypass in file_loaderPyPI · thumbor · fixed in 7.8.0
- CVE-2026-53505Thumbor proportion filter allows unbounded post-transform resize leading to remote DoSPyPI · thumbor · fixed in 7.8.0
- CVE-2026-53504Thumbor has Regex Denial of Service (ReDoS) in `convolution` filterPyPI · thumbor · fixed in 7.8.0
- CVE-2026-53503Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoSPyPI · thumbor · fixed in 7.8.0
- CVE-2026-53501Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signaturePyPI · thumbor · fixed in 7.8.0
- CVE-2026-53500Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dotPyPI · thumbor · fixed in 7.8.0
- CVE-2026-54706OnionShare follows symlinks in shared directories, allowing unintended disclosure of local filesPyPI · onionshare-cli · fixed in 2.6.4
- CVE-2026-54707OnionShare Receive mode writes uploaded files even when file uploads are disabledPyPI · onionshare-cli · fixed in 2.6.4
- CVE-2026-59881AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflatePyPI · aiohttp · fixed in 3.14.2
- CVE-2026-61536Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCEPyPI · banks · fixed in 2.4.3
- CVE-2026-54249VercelAIAdapter trusts client-controlled `providerMetadata` to construct `UploadedFile` — S3/GCS confused deputy via provider metadata injectionPyPI · pydantic-ai, pydantic-ai-slim · fixed in 1.106.0, 2.0.0b6
- CVE-2026-46678Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)PyPI · pydantic-ai, pydantic-ai-slim · fixed in 1.99.0
- CVE-2026-67435linuxfabrik-lib: fetch() forwards credential headers across a cross-origin redirectPyPI · linuxfabrik-lib · fixed in 6.0.0
- CVE-2026-67429Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)PyPI · flyto-core · fixed in 2.26.7
- CVE-2026-67428Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata)PyPI · flyto-core · fixed in 2.26.7
- CVE-2026-67427Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylistedPyPI · flyto-core · fixed in 2.26.7