Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-40213OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints.PyPI · openstack-cyborg · fixed in 16.0.1
- CVE-2026-40214In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer.PyPI · openstack-cyborg · fixed in 16.0.1
- CVE-2026-40171Jupyter Notebook and JupyterLab token theft via stored XSS in help command linkerPyPI · jupyterlab, notebook · fixed in 4.5.7, 7.5.6
- CVE-2026-33079Mistune ReDoS in LINK_TITLE_RE allows denial of service with crafted Markdown titlesPyPI · mistune · fixed in 3.2.1
- CVE-2026-29090Rucio SQL injection in postgres_meta DID search path compromises PostgreSQL metadata databasePyPI · rucio · fixed in 35.8.5, 38.5.5, 39.4.2 and more
- CVE-2026-29080Rucio SQL Injection in FilterEngine Oracle JSON Path via DID Search APIPyPI · rucio · fixed in 35.8.5, 38.5.5, 39.4.2 and more
- CVE-2026-6420Keylime: keylime: security bypass due to hardcoded tpm quote noncePyPI · keylime · fixed in 7.14.2
- CVE-2026-44405In Paramiko through 4.0.0 before a448945, rsakey.py allows the SHA-1 algorithm.PyPI · paramiko
- CVE-2026-40934jupyter-server authentication cookies remain valid after password reset due to static cookie secretPyPI · jupyter-server · fixed in 2.18.0
- CVE-2026-40110jupyter-server CORS origin validation bypass via unanchored regex in allow_origin_patPyPI · jupyter-server · fixed in 2.18.0
- CVE-2026-35397jupyter-server path traversal allows access to sibling directories sharing root_dir name prefixPyPI · jupyter-server · fixed in 2.18.0
- CVE-2026-27960OpenCTI privilege escalation and unauthenticated access via default admin accountPyPI · pycti · fixed in 6.9.13
- CVE-2026-7847chatchat-space Langchain-Chatchat Uploaded File openai_routes.py _get_file_id random valuesPyPI · langchain-chatchat
- CVE-2026-7846chatchat-space Langchain-Chatchat OpenAI-Compatible File Upload API openai_routes.py files toctouPyPI · langchain-chatchat
- CVE-2026-7845chatchat-space Langchain-Chatchat Vision Chat Paste Image dialogue.py PIL.Image.tobytes weak hashPyPI · langchain-chatchat
- CVE-2025-61669jupyter_server next parameter open redirect can redirect users to external domainsPyPI · jupyter-server · fixed in 2.18.0
- CVE-2026-35192Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUESTPyPI · django · fixed in 6.0.5, 5.2.14
- CVE-2026-6907Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddlewarePyPI · django · fixed in 5.2.14, 6.0.5
- CVE-2026-5766Potential denial-of-service vulnerability in ASGI requests via file upload limit bypassPyPI · django · fixed in 6.0.5, 5.2.14
- CVE-2026-42997An issue was discovered in idrac in OpenStack Ironic before 35.0.1.PyPI · ironic-python-agent · fixed in 35.0.1, 32.0.1, 29.0.5 and more
- CVE-2026-43002An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3.PyPI · horizon · fixed in 25.7.3
- CVE-2026-42088OpenC3 COSMOS: Administrative Actions via the Script Runner ToolPyPI · openc3 · fixed in 7.0.0
- CVE-2026-42087OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data BasePyPI · openc3 · fixed in 7.0.0
- CVE-2026-42086OpenC3 COSMOS: Self-XSS in the Command SenderPyPI · openc3 · fixed in 7.0.0
- CVE-2026-42085OpenC3 COSMOS: Arbitrary write to plugins directory via path-traversed config filenamesPyPI · openc3 · fixed in 6.10.5
- CVE-2026-42084OpenC3 COSMOS: Hijacked session token can be used to reset password for persistencePyPI · openc3 · fixed in 6.10.5
- CVE-2026-42052beets is Vulnerable to XSSPyPI · beets · fixed in 2.10.0
- CVE-2026-42080PPTAgent: Arbitrary File Write via `save_generated_slides`PyPI · pptagent · fixed in 1.1.36
- CVE-2026-42079PPTAgent: Arbitrary Code Execution via Python eval() of LLM-Generated Code with Builtins in ScopePyPI · pptagent · fixed in 1.1.36
- CVE-2026-42078PPTAgent: Arbitrary File Write + Directory Creation via markdown_table_to_imagePyPI · pptagent · fixed in 1.1.36