Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-44199Wagtail: Improper permission handling when deleting form submissionsPyPI · wagtail · fixed in 7.0.7, 7.3.2
- CVE-2026-44198Wagtail: Improper permission handling when viewing page historyPyPI · wagtail · fixed in 7.0.7, 7.3.2
- CVE-2026-44197Wagtail: Improper permission handling when comparing revisionsPyPI · wagtail · fixed in 7.0.7, 7.3.2
- CVE-2026-7820pgAdmin 4: Account-lockout bypass via Flask-Security default /login viewPyPI · pgadmin4 · fixed in 9.15
- CVE-2026-7819pgAdmin 4: Symbolic-link path traversal in File Manager allows arbitrary file writePyPI · pgadmin4 · fixed in 9.15
- CVE-2026-7818pgAdmin 4: Unsafe deserialization (CWE-502) in file-backed session manager leads to remote code executionPyPI · pgadmin4 · fixed in 9.15
- CVE-2026-7817pgAdmin 4: Local file inclusion and server-side request forgery in LLM API configuration endpointsPyPI · pgadmin4 · fixed in 9.15
- CVE-2026-7816pgAdmin 4: OS command injection in Import/Export query export via psql metacommand breakoutPyPI · pgadmin4 · fixed in 9.15
- CVE-2026-7815pgAdmin 4: SQL injection in Maintenance tool option values leading to remote code executionPyPI · pgadmin4 · fixed in 9.15
- CVE-2026-7814pgAdmin 4: Stored XSS via crafted PostgreSQL object names in Browser Tree and Explain VisualizerPyPI · pgadmin4 · fixed in 9.15
- CVE-2026-7813pgAdmin 4: Cross-user data access and shared-server privilege escalation in server modePyPI · pgadmin4 · fixed in 9.15
- CVE-2026-41018Apache Airflow Providers Elasticsearch: Elasticsearch task-log handler leaks credentials embedded in the host URLPyPI · apache-airflow-providers-elasticsearch · fixed in 6.5.3
- CVE-2026-43826Apache Airflow Providers OpenSearch: OpenSearch task-log handler leaks credentials embedded in the host URLPyPI · apache-airflow-providers-opensearch · fixed in 1.9.1
- CVE-2026-31246GPT-Pilot thru commit 0819827ce20346ef5f25b3fe29293cb448840565 (2025-09-03) contains a command injection vulnerability (CWE-78) in the ExecuPyPI · gpt-pilot
- CVE-2026-31247Docling's JATS XML backend is vulnerable to XML Entity Expansion (XXE) attacks thru 2.61.0.PyPI · docling
- CVE-2026-31248Docling's METS GBS backend is vulnerable to XML Entity Expansion (XXE) attacks thru 2.61.0.PyPI · docling
- CVE-2026-31253The flash-attention training framework thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains an insecure deserializatioPyPI · flash-attn
- CVE-2021-47935Sentry 8.2.0 Remote Code Execution via Pickle DeserializationPyPI · sentry · fixed in 8.1.4, 8.2.2
- CVE-2026-8213OSGeo gdal Grid File GDapi.c GDSDfldsrch heap-based overflowPyPI · gdal · fixed in 3.13.0
- CVE-2026-8212OSGeo gdal SWapi.c SWSDfldsrch heap-based overflowPyPI · gdal · fixed in 3.13.0RC1
- CVE-2026-42601ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddViewPyPI · archivebox
- CVE-2026-42311Pillow: OOB Write with Invalid PSD Tile Extents (Integer Overflow)PyPI · pillow · fixed in 12.2.0
- CVE-2026-42310Pillow: PDF Parsing Trailer Infinite Loop (DoS)PyPI · pillow · fixed in 12.2.0
- CVE-2026-42308Pillow: Integer overflow when processing fontsPyPI · pillow · fixed in 12.2.0
- CVE-2026-42309Pillow: Heap buffer overflow with nested list coordinatesPyPI · pillow · fixed in 12.2.0
- CVE-2026-42301Improper Input Validation leading to Improper Control of Generation of Code ('Code Injection') in pyp2specPyPI · pyp2spec · fixed in 0.14.1
- CVE-2026-42354Sentry: Improper authentication on SAML SSO process allows user identity linkingPyPI · sentry · fixed in 26.4.1
- CVE-2026-42352pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes SubscriberPyPI · pygeoapi · fixed in 0.23.3
- CVE-2026-42351pygeoapi: Path Traversal in STAC FileSystemProviderPyPI · pygeoapi · fixed in 0.23.3
- CVE-2026-41486Ray: Remote Code Execution via Parquet Arrow Extension Type DeserializationPyPI · ray, ve-ray · fixed in 2.55.0