Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-47392PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)PyPI · praisonai, praisonaiagents · fixed in 4.6.40, 1.6.40
- CVE-2026-47391PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool executionPyPI · praisonai · fixed in 4.6.40
- CVE-2026-47390PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodingsPyPI · praisonai, praisonaiagents · fixed in 4.6.40, 1.6.40
- CVE-2026-47144Shamefile has an arbitrary file read via shamefile.yaml in shame nextPyPI · shamefile · fixed in 0.1.7
- CVE-2026-46715Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptancePyPI · flask-security-too · fixed in 5.8.1
- CVE-2026-12484Unsafe Deserialization in keras.layers.TorchModuleWrapper.from_configPyPI · keras · fixed in 3.12.3, 3.15.0
- CVE-2023-54366SurrealDB before 1.0.1 Insecure Default Table PermissionsPyPI · surrealdb · fixed in 1.0.1
- CVE-2026-50271dd-trace-py: Improper parsing of W3C baggage headers may lead to DoSPyPI · ddtrace · fixed in 4.8.2
- CVE-2026-49852joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)PyPI · joserfc · fixed in 1.6.8
- CVE-2026-8505Authentication Bypass in Webhook Endpoints Allowed Unauthorized Flow ExecutionPyPI · langflow · fixed in 1.9.1
- CVE-2026-45309AsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal usernamePyPI · asyncssh · fixed in 2.23.0
- CVE-2026-48487Zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packetPyPI · zeroconf · fixed in 0.149.16
- CVE-2026-48045Zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source floodPyPI · zeroconf · fixed in 0.149.12
- CVE-2026-47184Zeroconf: Unbounded DNS record cache allows LAN-local memory exhaustion via multicast floodPyPI · zeroconf · fixed in 0.149.7
- CVE-2026-47183Zeroconf: Unbounded exception-dedup state retains packet buffers via traceback frame locals, enabling LAN-local memory exhaustionPyPI · zeroconf · fixed in 0.149.6
- CVE-2026-47180Zeroconf: Unbounded recursion in DNS compression-pointer decoder allows LAN-local denial of servicePyPI · zeroconf · fixed in 0.149.5
- CVE-2026-44722pyzipper: Encryption bypass for small files encrypted with pyzipperPyPI · pyzipper · fixed in 0.4.0
- CVE-2026-43977wger IDOR: Authenticated Users Can Read Others' Private Workout Session Data via Template Routine APIPyPI · wger
- CVE-2026-43978wger: Privilege escalation via trainer-login session chaining allows gym trainers to impersonate gym managersPyPI · wger
- CVE-2026-44182Jupyter Enterprise Gateway Has Kubernetes Manifest Injection via Jinja2 Template RenderingPyPI · jupyter-enterprise-gateway · fixed in 3.3.0
- CVE-2026-44181Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection results in Remote Code ExecutionPyPI · jupyter-enterprise-gateway · fixed in 3.3.0
- CVE-2026-44180Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids can be BypassedPyPI · jupyter-enterprise-gateway · fixed in 3.3.0
- CVE-2026-44023Docling Core has unsafe remote filename resolutionPyPI · docling-core · fixed in 2.74.1
- CVE-2026-44019Docling Core has insufficient validation of image reference URIsPyPI · docling-core · fixed in 2.74.1
- CVE-2026-46338PyMdown Extensions: Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_pathPyPI · pymdown-extensions · fixed in 10.21.3
- CVE-2026-44969dbt-mcp: Tool Arguments Including SQL Queries and Credentials Logged in Plaintext Without Redaction When File Logging Is EnabledPyPI · dbt-mcp · fixed in 1.17.1
- CVE-2026-44970dbt-mcp: All MCP Tool Arguments Including Raw SQL and --vars Credentials Transmitted to dbt Labs Telemetry by Default Without RedactionPyPI · dbt-mcp · fixed in 1.17.1
- CVE-2026-44968dbt-mcp: Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type ParametersPyPI · dbt-mcp · fixed in 1.17.1
- CVE-2026-45568zrok Python ProxyShare can be used as an SSRF proxy through absolute URL pathsPyPI · zrok
- CVE-2026-53598Prompty: Arbitrary File Read via ${file:path} Reference ExpansionPyPI · prompty · fixed in 2.0.0b2