Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-44020Docling: Unsafe XML Entity Expansion in USPTO Patent BackendPyPI · docling · fixed in 2.74.0
- CVE-2026-44016Docling: Unsafe Playwright-based HTML RenderingPyPI · docling · fixed in 2.91.0
- CVE-2026-49851Mistune: Potential DoS via quadratic-time parsing in parse_link_textPyPI · mistune · fixed in 3.3.0
- CVE-2026-55488motionEye's Absolute Path Traversal in Media File Handlers Allows Arbitrary File ReadPyPI · motioneye · fixed in 0.44.0
- CVE-2026-56121Feast < 0.63.0 Unauthenticated RCE via ApplyFeatureView gRPC DeserializationPyPI · feast · fixed in 0.63.0
- CVE-2026-56262Crawl4AI - Unauthenticated Access to Monitor Endpoints via Docker API ServerPyPI · crawl4ai · fixed in 0.8.7
- CVE-2025-71361picklescan - Remote Code Execution via Undetected idlelib.calltip.Calltip.fetch_tipPyPI · picklescan · fixed in 0.0.29
- CVE-2025-71354picklescan - Remote Code Execution via idlelib.debugobj.ObjectTreeItem.SetTextPyPI · picklescan · fixed in 0.0.29
- CVE-2026-9073Foreman-mcp-server: mcp server: insecure sensitive http header sanitizationPyPI · foreman-mcp-server
- CVE-2026-53753Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker APIPyPI · crawl4ai · fixed in 0.8.7
- CVE-2026-53754Crawl4AI: SSRF filter bypass in Docker server via IPv6 transition forms (NAT64 / 6to4 / unspecified / v4-mapped)PyPI · crawl4ai · fixed in 0.8.8
- CVE-2026-53755Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF checkPyPI · crawl4ai · fixed in 0.8.9
- CVE-2026-54317Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LANPyPI · homeassistant · fixed in 2026.6.0
- CVE-2026-50221In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers (X-Container-Host, X-Container-Device, X-Delete-At-HosPyPI · swift · fixed in 2.37.2
- CVE-2026-54007Open WebUI: Cross-origin postMessage confirmation bypass via action:submitPyPI · open-webui · fixed in 0.9.6
- CVE-2026-54006Open WebUI: Calendar event re-parenting allows writing events into another user's calendarPyPI · open-webui · fixed in 0.9.6
- CVE-2026-54008Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url`PyPI · open-webui · fixed in 0.9.6
- CVE-2026-54009Open WebUI: Cross-user file disclosure via /api/chat/completions image_url fieldPyPI · open-webui · fixed in 0.9.6
- CVE-2026-54010Open WebUI: Forged chat-file link allows cross-user file read and deletionPyPI · open-webui · fixed in 0.9.6
- CVE-2026-54011Open WebUI: Stored XSS in Mermaid Markdown PreviewPyPI · open-webui · fixed in 0.9.6
- CVE-2026-54012Open WebUI: Forged model meta.knowledge allows cross-user file read and deletionPyPI · open-webui · fixed in 0.9.6
- CVE-2026-54013Open WebUI: Stored XSS to Account Takeover via Model Profile Images in Open WebUIPyPI · open-webui · fixed in 0.9.6
- CVE-2026-54014Open WebUI: Sibling-Prefix Path Traversal via /cache/{path} in open-webui/open-webuiPyPI · open-webui · fixed in 0.9.6
- CVE-2026-54015Open WebUI: Prompt history IDOR: unbound history_id allows cross-prompt read and deletionPyPI · open-webui · fixed in 0.9.6
- CVE-2026-54016Open WebUI: Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File EnumerationPyPI · open-webui · fixed in 0.9.6
- CVE-2026-54018Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP RedirectsPyPI · open-webui · fixed in 0.9.6
- CVE-2026-54019Open WebUI: RAG ACL Bypass in Milvus Multitenancy ModePyPI · open-webui · fixed in 0.9.6
- CVE-2026-54021Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path parameterPyPI · open-webui · fixed in 0.9.6
- CVE-2026-54022Open WebUI: Any authenticated user can read other users' private notes via Socket.IOPyPI · open-webui · fixed in 0.8.11
- CVE-2026-48520Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file readPyPI · langflow · fixed in 1.10.0