Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-41425Authlib: Cross-site request forging when using cachePyPI · authlib · fixed in 1.6.11
- CVE-2026-41140Poetry: Path traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4PyPI · poetry · fixed in 2.3.4
- CVE-2026-41066lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local filesPyPI · lxml · fixed in 6.1.0
- CVE-2026-25660Authentication bypass for certain API callsPyPI · codechecker
- CVE-2026-38743Apache Airflow: Dags endpoint might provide access to otherwise inaccessible entitiesPyPI · apache-airflow, apache-airflow-core · fixed in 3.0.0, 3.2.1rc1, 3.2.1
- CVE-2026-40690Apache Airflow: Assets graph view bypasses DAG level access control displaying unrelated topologies and all DAGs names to unauthorized usersPyPI · apache-airflow, apache-airflow-core · fixed in 3.0.0, 3.2.1rc1, 3.2.1
- CVE-2026-41205Mako: Path traversal via double-slash URI prefix in TemplateLookupPyPI · mako · fixed in 1.3.11
- CVE-2026-41241pretalx: Stored cross-site scripting in organiser search typeaheadPyPI · pretalx · fixed in 2026.1.0
- CVE-2025-62373Pipecat vulnerable to Remote Code Execution by Pickle Deserialization via LivekitFrameSerializerPyPI · pipecat-ai · fixed in 0.0.94
- CVE-2026-3960Remote Code Execution in h2oai/h2o-3PyPI · h2o · fixed in 3.46.0.10
- CVE-2026-41206PySpector has a Plugin Code Execution Bypass via Incomplete Static Analysis in PluginSecurity.validate_plugin_codePyPI · pyspector · fixed in 0.1.8
- CVE-2026-41182LangSmith SDK: Streaming token events bypass output redactionPyPI · langsmith · fixed in 0.7.31
- CVE-2026-6878ByteDance verl grader.py math_equal sandboxPyPI · verl
- CVE-2026-41314pypdf: Manipulated FlateDecode image dimensions can exhaust RAMPyPI · pypdf · fixed in 6.10.2
- CVE-2026-41313pypdf: Possible long runtimes for wrong size values in incremental modePyPI · pypdf · fixed in 6.10.2
- CVE-2026-41312pypdf: Manipulated FlateDecode predictor parameters can exhaust RAMPyPI · pypdf · fixed in 6.10.2
- CVE-2026-41168pypdf has possible long runtimes for wrong size values in cross-reference and object streamsPyPI · pypdf · fixed in 6.10.1
- CVE-2026-6859Instructlab: instructlab: arbitrary code execution due to hardcoded `trust_remote_code=true`PyPI · instructlab
- CVE-2026-6855Instructlab: instructlab: path traversal allows arbitrary directory creation and file writePyPI · instructlab
- CVE-2026-41133pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)PyPI · pyload-ng
- CVE-2026-40606ProxyAuth Addon LDAP Injection in mitmproxyPyPI · mitmproxy · fixed in 12.2.2
- CVE-2026-40602hass-cli: Handling of user-supplied Jinja2 templatesPyPI · homeassistant-cli · fixed in 1.0.0
- CVE-2026-40594pyLoad: Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)PyPI · pyload-ng · fixed in 0.5.0b3.dev98, 0.5.0b3.dev69
- CVE-2026-40576Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in excel-mcp-serverPyPI · excel-mcp-server · fixed in 0.1.8
- CVE-2026-39378nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image EmbeddingPyPI · nbconvert · fixed in 7.17.1
- CVE-2026-39377nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment FilenamesPyPI · nbconvert · fixed in 7.17.1
- CVE-2026-35588Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config ValuesPyPI · glances · fixed in 4.5.4
- CVE-2026-35587Glances IP Plugin has SSRF via public_api that leads to credential leakagePyPI · glances · fixed in 4.5.4
- CVE-2026-34839Glances Vulnerable to Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORSPyPI · glances · fixed in 4.5.4
- CVE-2026-33626LMDeploy Vulnerable to Server-Side Request Forgery (SSRF) via Vision-Language Image LoadingPyPI · lmdeploy