Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-61437PraisonAI before 1.6.78 Remote Code Execution via tools.pyPyPI · praisonaiagents · fixed in 1.6.78
- CVE-2026-61434PraisonAI before 4.6.78 Allowlist Bypass via find -execPyPI · praisonai · fixed in 4.6.78
- CVE-2026-61432PraisonAI FastContext before 1.6.78 Path TraversalPyPI · praisonaiagents · fixed in 1.6.78
- CVE-2026-61431PraisonAI before 4.6.78 Path Traversal via ContextGathererPyPI · praisonai · fixed in 4.6.78
- CVE-2026-60091PraisonAI before 4.6.78 Unauthenticated SSRF via webhook_urlPyPI · praisonai · fixed in 4.6.78
- CVE-2026-60089PraisonAI before 1.6.78 Path Traversal via config.tomlPyPI · praisonaiagents · fixed in 1.6.78
- CVE-2026-60086PraisonAI before 4.6.78 Prompt Injection Defense BypassPyPI · praisonai · fixed in 4.6.78
- CVE-2026-56261Crawl4AI - Server-Side Request Forgery via Webhook URLsPyPI · crawl4ai · fixed in 0.8.7
- CVE-2026-54771Langroid: handle_message() executes user-supplied tool JSON without sender verificationPyPI · langroid · fixed in 0.65.3
- CVE-2026-54769Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgentPyPI · langroid · fixed in 0.65.2
- CVE-2026-54760Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file callsPyPI · langroid · fixed in 0.65.1
- CVE-2026-50181Langroid: Path traversal in the file tools allows read/write outside configured current directoryPyPI · langroid · fixed in 0.64.0
- CVE-2026-50180Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file readPyPI · langroid · fixed in 0.64.0
- CVE-2026-55615Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-25879PyPI · langroid · fixed in 0.65.5
- CVE-2026-55865Python Liquid: Infinite loop when parsing malformed `{% case %}` tagsPyPI · python-liquid · fixed in 2.2.1
- CVE-2026-54695Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SIDPyPI · pipecat-ai · fixed in 1.4.0
- CVE-2026-58198ChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainerPyPI · chatterbot · fixed in 1.2.14
- CVE-2026-59221open-webui terminal proxy path traversal guard bypass via 9x encoded traversalPyPI · open-webui · fixed in 0.10.0
- CVE-2026-59225Open WebUI: Arena task endpoints can bypass underlying model access controlsPyPI · open-webui · fixed in 0.10.0
- CVE-2026-59224Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)PyPI · open-webui · fixed in 0.10.0
- CVE-2026-59212Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/deletePyPI · open-webui · fixed in 0.10.0
- CVE-2026-59223Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matchingPyPI · open-webui · fixed in 0.10.0
- CVE-2026-59222Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentialsPyPI · open-webui · fixed in 0.10.0
- CVE-2026-59215Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id bindingPyPI · open-webui · fixed in 0.10.0
- CVE-2026-59213Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)PyPI · open-webui · fixed in 0.10.0
- CVE-2026-59217Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)PyPI · open-webui · fixed in 0.10.0
- CVE-2026-59216Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_idPyPI · open-webui · fixed in 0.10.0
- CVE-2026-59219Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logoutPyPI · open-webui · fixed in 0.10.0
- CVE-2026-59715Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)PyPI · open-webui · fixed in 0.10.0
- CVE-2026-59220Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default configPyPI · open-webui · fixed in 0.10.0