Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-58339LlamaIndex <= 0.12.2 VannaQueryEngine SQL Execution Allows Resource ExhaustionPyPI · llama-index · fixed in 0.12.3
- CVE-2026-22798hermes's raw options logging may disclose secrets passed in via subcommand options argumentPyPI · hermes · fixed in 0.9.1
- CVE-2026-22251wlc may leak API keys due to an insecure API key configurationPyPI · wlc · fixed in 1.17.0
- CVE-2026-22250wlc can skip SSL verificationPyPI · wlc · fixed in 1.17.0
- CVE-2026-22033Label Studio vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys fieldPyPI · label-studio
- CVE-2025-68472MindsDB has improper sanitation of filepath that leads to information disclosure and DOSPyPI · mindsdb · fixed in 25.11.1
- CVE-2025-14279DNS Rebinding Vulnerability in mlflow/mlflowPyPI · mlflow · fixed in 3.5.0
- CVE-2025-15506AcademySoftwareFoundation OpenColorIO FileRules.cpp ConvertToRegularExpression out-of-boundsPyPI · opencolorio · fixed in 2.5.1
- CVE-2025-15504lief-project LIEF ELF Binary Parser.tcc parse_binary null pointer dereferencePyPI · lief · fixed in 0.17.2
- CVE-2026-22777ComfyUI-Manager is Vulnerable to CRLF Injection in Configuration HandlerPyPI · comfy-cli · fixed in 4.0.5, 3.39.2
- CVE-2026-22773vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensionsPyPI · vllm · fixed in 0.12.0
- CVE-2026-22702virtualenv Has TOCTOU Vulnerabilities in Directory CreationPyPI · virtualenv · fixed in 20.36.1
- CVE-2026-22701filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLockPyPI · filelock · fixed in 3.20.3
- CVE-2026-22691pypdf has possible long runtimes for malformed startxrefPyPI · pypdf · fixed in 6.6.0
- CVE-2026-22690pypdf has possible long runtimes for missing /Root object with large /Size valuesPyPI · pypdf · fixed in 6.6.0
- CVE-2026-22612Fickling vulnerable to detection bypass due to "builtins" blindnessPyPI · fickling · fixed in 0.1.7
- CVE-2026-22609Fickling has Static Analysis Bypass via Incomplete Dangerous Module BlocklistPyPI · fickling · fixed in 0.1.7
- CVE-2026-22608Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detectionPyPI · fickling · fixed in 0.1.7
- CVE-2026-22607Fickling Blocklist Bypass: cProfile.run()PyPI · fickling · fixed in 0.1.7
- CVE-2026-22606Fickling has a bypass via runpy.run_path() and runpy.run_module()PyPI · fickling · fixed in 0.1.7
- CVE-2026-22584Improper Control of Generation of Code ('Code Injection') vulnerability in Salesforce Uni2TS on MacOS, Windows, Linux allows Leverage ExecutPyPI · uni2ts · fixed in 2.0.0
- CVE-2026-21860Werkzeug safe_join() allows Windows special device names with compound extensionsPyPI · werkzeug · fixed in 3.1.5
- CVE-2025-68158Authlib: 1-click Account TakeoverPyPI · authlib · fixed in 1.6.6
- CVE-2026-22041loggingredactor converts non-string types to string types in logsPyPI · loggingredactor · fixed in 0.0.6
- CVE-2026-21892Parsl Monitoring Visualization Vulnerable to SQL InjectionPyPI · parsl · fixed in 2026.01.05
- CVE-2026-21874NiceGUI has Redis connection leak via tab storage causes service degradationPyPI · nicegui · fixed in 3.5.0
- CVE-2026-21873Zero-click XSS in all NiceGUI apps which uses `ui.sub_pages`PyPI · nicegui · fixed in 3.5.0
- CVE-2026-21872NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided linksPyPI · nicegui · fixed in 3.5.0
- CVE-2026-21871NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()PyPI · nicegui · fixed in 3.5.0
- CVE-2026-21883Bokeh server applications have Incomplete Origin Validation in WebSocketsPyPI · bokeh · fixed in 3.8.2