Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-11407Pimcore CMS 12.3.8 Twig Sandbox Bypass via SecurityPolicy checkMethodAllowedPackagist · pimcore/pimcore
- CVE-2026-55748OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharaPyPI · horizon
- CVE-2025-26240In JazzCore python-pdfkit 1.0.0, the from_string method enables the execution of JavaScript code within the context of the server applicatioPyPI · pdfkit
- CVE-2026-12398Galaxy_ng: shell injection in legacy role import via unsanitized git ref namesPyPI · galaxy-ng
- CVE-2026-41708Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerabilityMaven · org.springframework.cloud:spring-cloud-sleuth-instrumentation
- CVE-2026-12202Intelliants Subrion CMS Blocks Endpoint cross site scriptingPackagist · intelliants/subrion
- CVE-2026-12198Microweber API Endpoint thumbnail_img userfiles_path path traversalPackagist · microweber/microweber
- CVE-2026-39006An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component.Maven · org.snmp4j:snmp4j-agent
- CVE-2026-50879An issue in the uploadPostHandler component of Andrei Marcu linx-server v2.3.8 allows attackers to cause a Denial of Service (DoS) via a craGo · github.com/andreimarcu/linx-server
- CVE-2026-50880An issue in the sendmail transport integration component of YouTransfer v1.0.6 allows attackers to execute arbitrary code via supplying a crnpm · youtransfer
- CVE-2026-50884Incorrect access control in statping-ng v0.93.0 allows attackers to escalate privileges to Administrator and access sensitive components.Go · github.com/statping-ng/statping-ng
- CVE-2026-50886Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via aPackagist · grumpydictator/firefly-iii
- CVE-2026-50887A Server-Side Request Forgery (SSRF) in the automatic short URL title resolution component of shlink v5.0.1 allows attackers to scan internaPackagist · shlinkio/shlink
- CVE-2026-50891Incorrect access control in the /admin/api/config component of Filestash v0.4.0 allows attackers to escalate privileges via sending a crafteGo · github.com/mickael-kerjean/filestash
- CVE-2026-45013Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validationnpm · apostrophe
- CVE-2026-45012Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widgetnpm · apostrophe
- CVE-2026-45011Apostrophe has stored XSS via javascript: URL in Image Widget Linknpm · apostrophe
- CVE-2026-42853@apostrophecms/cli: Command Injection in apos create via Unsanitized Password Inputnpm · @apostrophecms/cli
- CVE-2026-44172MariaDB: mysql_real_escape_string() incorrectly handled big5PyPI · mariadb
- CVE-2026-45833A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary cPyPI · chromadb
- CVE-2026-45831The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a usePyPI · chromadb
- CVE-2026-46690unbounded-spsc: Sender::send pointer-as-value transmute causes OOB read and fake-Arc drop under TX/RX racecrates.io · unbounded-spsc
- CVE-2026-45830A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily rPyPI · chromadb
- CVE-2026-47213BoxLite: Timeout Bypass VulnerabilityPyPI · boxlite
- CVE-2026-53698Silverpeas through 6.4.6 mishandles the "Personal space" feature that is selected when no componentId is set.Maven · org.silverpeas.core:silverpeas-core, org.silverpeas.core:silverpeas-core-war
- CVE-2026-46539nimiq-primitives: BlockInclusionProof interlink issue when hops are emptycrates.io · nimiq-primitives
- CVE-2026-53675BuddyPress 14.4.0 Friends List IDOR via REST APIPackagist · buddypress/buddypress
- CVE-2026-50636LimeSurvey RemoteControl invite_participants/remind_participants SQL InjectionPackagist · limesurvey/limesurvey
- CVE-2026-50635LimeSurvey Password Reset Host Header Injection Discloses Reset TokenPackagist · limesurvey/limesurvey
- CVE-2026-52902Awxkit: path traversal via yaml !include directivePyPI · awxkit