Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-10219nextlevelbuilder GoClaw write_file Tool fsbridge.go FsBridge.WriteFile os command injectionGo · github.com/nextlevelbuilder/goclaw
- CVE-2026-10215Dolibarr ERP CRM Leave Request REST API api_holidays.class.php checkUserAccessToObject improper authorizationPackagist · dolibarr/dolibarr
- CVE-2026-10212AstrBotDevs AstrBot astr_main_agent.py astr_main_agent authorizationPyPI · astrbot
- CVE-2026-10177Aider-AI Aider AWS EC2 Metadata Endpoint api_docs.py requests.get server-side request forgeryPyPI · aider-chat
- CVE-2026-10175Aider-AI Aider Architect Mode auth.py editor_coder.run code injectionPyPI · aider-chat
- CVE-2026-44697Klever-Go MultiDataInterceptor: remote OOM via crafted compressed P2P payloadGo · github.com/klever-io/klever-go
- CVE-2026-45626Arcane: OS Command Injection in Volume Browser ListDirectory via path query parameterGo · github.com/getarcaneapp/arcane/backend
- CVE-2026-10105agno 2.6.5 SQL Injection via ClickHouse delete_by_metadata()PyPI · agno
- CVE-2026-45580WWBN AVideo Live: stored XSS via unescaped stream key in modeYoutubeLive.php class attributePackagist · wwbn/avideo
- CVE-2026-45578WWBN AVideo Live: OS command injection in on_publish.php execAsync via unescaped m3u8 URLPackagist · wwbn/avideo
- CVE-2026-45610WWBN AVideo plugin/LoginControl/set.json.php: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FAPackagist · wwbn/avideo
- CVE-2026-45619AVideo CVE-2026-43884 incomplete fix - `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD postPackagist · wwbn/avideo
- CVE-2026-45620AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumerationPackagist · wwbn/avideo
- CVE-2026-45731WWBN AVideo: Authenticated Arbitrary File Read in view/update.phpPackagist · wwbn/avideo
- CVE-2026-46337WWBN AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php`Packagist · wwbn/avideo
- CVE-2026-47694WWBN AVideo: Stored XSS via unescaped Gallery category descriptionPackagist · wwbn/avideo
- CVE-2026-47696WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpointPackagist · wwbn/avideo
- CVE-2026-45058electerm: Import unsafe bookmark data could lead to unsafe operation when click local type bookmarknpm · electerm
- CVE-2026-45306pyLoad: Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session DirectoryPyPI · pyload-ng
- CVE-2026-45348pyLoad: Stored XSS in Downloads view via unsanitized link URL in packages.js template literalPyPI · pyload-ng
- CVE-2026-9098CVE-2026-9098Go · github.com/casdoor/casdoor
- CVE-2026-9097CVE-2026-9097Go · github.com/casdoor/casdoor
- CVE-2026-9096CVE-2026-9096Go · github.com/casdoor/casdoor
- CVE-2026-9093CVE-2026-9093Go · github.com/casdoor/casdoor
- CVE-2026-9091CVE-2026-9091Go · github.com/casdoor/casdoor
- CVE-2026-9090CVE-2026-9090Go · github.com/casdoor/casdoor
- CVE-2026-9804Kubevirt: kubevirt: vmexport directory symlink escape enables exporter pod file readGo · kubevirt.io/kubevirt
- CVE-2026-9798Keycloak: keycloak: brute-force protection bypass in ciba flowMaven · org.keycloak:keycloak-services
- CVE-2026-9793Keycloak: keycloak: security policy bypass in jwe-encrypted request object processingMaven · org.keycloak:keycloak-services
- CVE-2026-45083Goobi viewer: Unauthenticated Solr Streaming Expression ProxyMaven · io.goobi.viewer:viewer-core