Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-27835wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout dataPyPI · wger
- CVE-2026-27457Weblate: Missing access control for the AddonViewSet API exposes all addon configurationsPyPI · weblate · fixed in 5.16.1
- CVE-2026-27975Ajenti has a potential Remote Code ExecutionPyPI · aj · fixed in 2.2.13
- CVE-2026-27966Langflow has Remote Code Execution in CSV AgentPyPI · langflow
- CVE-2026-27961Agenta's Server-Side Template Injection (SSTI) via custom evaluator Jinja2 templates allows RCEPyPI · agenta · fixed in 0.86.8
- CVE-2026-27952Agenta has Python Sandbox Escape, Leading to Remote Code Execution (RCE)PyPI · agenta · fixed in 0.48.1
- CVE-2026-27948Copyparty vulnerable to eflected cross-site scripting via setck parameterPyPI · copyparty · fixed in 1.20.9
- CVE-2026-27941OpenLIT Vulnerable to Remote Code Execution and Secret Exposure via Misuse of `pull_request_target` in GitHub Actions WorkflowsPyPI · openlit · fixed in 1.37.1
- CVE-2026-27888pypdf: Manipulated FlateDecode XFA streams can exhaust RAMPyPI · pypdf · fixed in 6.7.3
- CVE-2026-27809psd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gapsPyPI · psd-tools · fixed in 1.12.2
- CVE-2026-27735mcp-server-git : Path traversal in git_add allows staging files outside repository boundariesPyPI · mcp-server-git · fixed in 2026.1.14
- CVE-2026-25736Rucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE AttributePyPI · rucio-webui · fixed in 35.8.3, 38.5.4, 39.3.1
- CVE-2026-25735Rucio WebUI has a Stored Cross-site Scripting (XSS) vulnerability its Identity NamePyPI · rucio-webui · fixed in 35.8.3, 38.5.4, 39.3.1
- CVE-2026-25734Rucio WebUI has Stored Cross-site Scripting (XSS) in RSE MetadataPyPI · rucio-webui · fixed in 35.8.3, 38.5.4, 39.3.1
- CVE-2026-25733Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule FunctionPyPI · rucio-webui · fixed in 35.8.3, 38.5.4, 39.3.1
- CVE-2026-25138Rucio WebUI has Username Enumeration via Login Error MessagePyPI · rucio-webui · fixed in 35.8.3, 38.5.4, 39.3.1
- CVE-2026-25136Rucio WebUI has a Reflected Cross-site Scripting VulnerabilityPyPI · rucio-webui · fixed in 35.8.3, 38.5.4, 39.3.1
- CVE-2026-27794LangGraph: BaseCache Deserialization of Untrusted Data may lead to Remote Code ExecutionPyPI · langgraph-checkpoint · fixed in 4.0.0
- CVE-2026-27695zae-limiter: DynamoDB hot partition throttling enables per-entity Denial of ServicePyPI · zae-limiter · fixed in 0.10.1
- CVE-2026-27696changedetection.io Vulnerable to Server-Side Request Forgery (SSRF) via Watch URLsPyPI · changedetection-io · fixed in 0.54.1
- CVE-2026-27645changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error ResponsePyPI · changedetection-io · fixed in 0.53.7, 0.54.1
- CVE-2026-27641Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template InjectionPyPI · flask-reuploaded · fixed in 1.5.0
- CVE-2026-27628pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streamsPyPI · pypdf · fixed in 6.7.2
- CVE-2026-27614Bugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace renderingPyPI · bugsink · fixed in 2.0.13
- CVE-2026-26717An issue in OpenFUN Richie (LMS) in src/richie/apps/courses/api.py.PyPI · richie · fixed in 3.3.0
- CVE-2026-27156NiceGUI has XSS via Code InjectionPyPI · nicegui · fixed in 3.8.0
- CVE-2026-27483MindsDB has Path Traversal in /api/files Leading to Remote Code ExecutionPyPI · mindsdb · fixed in 25.9.1.1
- CVE-2026-23969Apache Superset: Exposure of Sensitive Information via Incomplete ClickHouse Function FilteringPyPI · apache-superset · fixed in 4.1.2
- CVE-2026-23980Apache Superset: Improper Neutralization of Special Elements used in a SQL CommandPyPI · apache-superset · fixed in 6.0.0
- CVE-2026-23982Apache Superset: Improper Authorization in Dataset Creation Allows Access Control BypassPyPI · apache-superset · fixed in 6.0.0