Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-31958Tornado has a DoS due to too many multipart partsPyPI · tornado · fixed in 6.5.5
- CVE-2026-31900Black's vulnerable version parsing leads to RCE in GitHub ActionPyPI · black · fixed in 26.3.0
- CVE-2026-31826pypdf: manipulated stream length values can exhaust RAMPyPI · pypdf · fixed in 6.8.0
- CVE-2026-31815django-unicorn affected by component state manipulation via unvalidated attribute accessPyPI · django-unicorn · fixed in 0.67.0
- CVE-2026-27825MCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachmentPyPI · mcp-atlassian · fixed in 0.17.0
- CVE-2026-27826MCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headersPyPI · mcp-atlassian · fixed in 0.17.0
- CVE-2026-30974Copyparty volflag `nohtml` did not block javascript in svg filesPyPI · copyparty · fixed in 1.20.11
- CVE-2026-26118Azure MCP Server Tools Elevation of Privilege VulnerabilityPyPI · msmcp-azure · fixed in 2.0.0b17
- CVE-2026-30930Glances has SQL Injection via Process Names in TimescaleDB ExportPyPI · glances · fixed in 4.5.1
- CVE-2026-30928Glances Exposes Unauthenticated Configuration SecretsPyPI · glances · fixed in 4.5.1
- CVE-2026-25960SSRF Protection Bypass in vLLMPyPI · vllm · fixed in 0.17.0
- CVE-2026-0846Arbitrary File Read via Absolute Path Input in nltk.util.filestring()PyPI · nltk · fixed in 3.9.3
- CVE-2026-25604Apache Airflow AWS Auth Manager - Host Header Injection Leading to SAML Authentication BypassPyPI · apache-airflow-providers-amazon · fixed in 9.22.0
- CVE-2025-69219Apache Airflow Providers Http: Unsafe Pickle Deserialization in apache-airflow-providers-http leading to RCE via HttpOperatorPyPI · apache-airflow-providers-http · fixed in 6.0.0
- CVE-2025-70050An issue pertaining to CWE-312: Cleartext Storage of Sensitive Information was discovered in lesspass lesspass v9.6.9 which allows attackersPyPI · lesspass
- CVE-2026-29787mcp-memory-service: System Information Disclosure via Health EndpointPyPI · mcp-memory-service · fixed in 10.21.0
- CVE-2026-29778pyLoad: Arbitrary File Write via Path Traversal in edit_package()PyPI · pyload-ng · fixed in 0.5.0b3.dev97
- CVE-2026-29780eml_parser: Path Traversal in Official Example Script Leading to Arbitrary File WritePyPI · eml-parser · fixed in 2.0.1
- CVE-2026-30242Plane: SSRF via Incomplete IP Validation in Webhook URL SerializerPyPI · plane · fixed in 1.2.3
- CVE-2026-30244Plane: Unauthenticated Workspace Member Information DisclosurePyPI · plane
- CVE-2026-29790dbt-common: commonprefix() doesn't protect against path traversalPyPI · dbt-common · fixed in 1.34.2, 1.37.3
- CVE-2026-29065changedetection.io: Zip Slip vulnerability in the backup restore functionalityPyPI · changedetection-io · fixed in 0.54.4
- CVE-2026-29039changedetection.io: XPath - Arbitrary File Read via unparsed-text()PyPI · changedetection-io · fixed in 0.54.4
- CVE-2026-29038changedetection.io: Reflected XSS in RSS Tag Error ResponsePyPI · changedetection-io · fixed in 0.54.4
- CVE-2026-28804pypdf: Inefficient decoding of ASCIIHexDecode streamsPyPI · pypdf · fixed in 6.7.5
- CVE-2026-28802Authlib: Setting `alg: none` and a blank signature appears to bypass signature verificationPyPI · authlib · fixed in 1.6.7
- CVE-2026-28438CocoIndex Doris target connector didn't verify table name when constructing ALTER TABLE statementsPyPI · cocoindex · fixed in 0.3.34
- CVE-2026-28795OpenChatBI: Critical Path Traversal Vulnerability in save_report Tool of OpenChatBIPyPI · openchatbi · fixed in 0.2.2
- CVE-2026-28681IRRd: web UI host header injection allows password reset poisoning via attacker-controlled email linksPyPI · irrd · fixed in 4.4.5, 4.5.1
- CVE-2026-0848Arbitrary Code Execution in NLTK StanfordSegmenter via Untrusted JAR LoadingPyPI · nltk · fixed in 3.9.3