Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-42877FacturaScripts: Stored XSS via product reference in sales/purchasesPackagist · facturascripts/facturascripts
- CVE-2026-42879FacturaScripts: Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product ImagesPackagist · facturascripts/facturascripts
- CVE-2026-42878FacturaScripts: Unauthenticated phpinfo() Disclosure via Installer Endpoint in FacturaScriptsPackagist · facturascripts/facturascripts
- CVE-2026-42081free5GC: UE Security Capability bypass on NGAP PathSwitchRequestGo · github.com/free5gc/amf
- CVE-2026-42082free5GC: Missing Concurrent NAS SMC Validation During NGAP HandoverGo · github.com/free5gc/amf
- CVE-2026-42459free5GC: Improper Input Validation and Generation of Error Message Containing Sensitive Information in github.com/free5gc/udmGo · github.com/free5gc/udm
- CVE-2026-44315free5GC: NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactionsGo · github.com/free5gc/nef
- CVE-2026-44320free5GC: NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing pathGo · github.com/free5gc/nef
- CVE-2026-44321free5GC: SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf)Go · github.com/free5gc/smf
- CVE-2026-44326free5GC: NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptionsGo · github.com/free5gc/nef
- CVE-2026-44327free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handlerGo · github.com/free5gc/nef
- CVE-2026-44330free5GC: NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptionsGo · github.com/free5gc/nef
- CVE-2026-44971GuardDog: Blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltrationPyPI · guarddog
- CVE-2026-44972GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package contentPyPI · guarddog
- CVE-2026-48544Taipy 4.1.1 Path Traversal via ElementLibrary.get_resource()PyPI · taipy
- CVE-2026-48927Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the build URL, resulting in a stored cross-site scripting (XSS) vulnerabilityMaven · org.jenkins-ci.plugins:buildgraph-view
- CVE-2026-9689Keycloak: org.keycloak.protocol.oidc: http parameter pollution in oidc redirect uri allows response parameter duplication - #ghi-604Maven · org.keycloak:keycloak-services
- CVE-2026-49017In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request boPyPI · swift
- CVE-2026-36045picoclaw <=v0.1.2 and earlier is vulnerable to OS command injection via the ExecTool component (pkg/tools/shell.go).Go · github.com/sipeed/picoclaw
- CVE-2026-45298Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)Go · github.com/amir20/dozzle
- CVE-2026-44985Dozzle: Cross-Site WebSocket Hijacking (CSWSH) on exec/attach endpoints bypasses authenticationGo · github.com/amir20/dozzle
- CVE-2026-44983smallbitvec: Safe API Triggered Heap Buffer Overflow via Integer Overflowcrates.io · smallbitvec
- CVE-2026-44966Velocity.js: Prototype Pollution in #set path assignmentnpm · velocityjs
- CVE-2026-47672epa4all-client: Unauthenticated REST API for Patient Record WritesMaven · com.oviva.telematik:epa4all-rest-service
- CVE-2026-41164nuts-node: JWT type confusion in v1 access token introspection allows VP replay as access tokenGo · github.com/nuts-foundation/nuts-node
- CVE-2026-9540vllm-project vllm OpenAI-compatible Serving Path denial of servicePyPI · vllm
- CVE-2026-9520blitz-js blitz Sign-in LoginForm.tsx cross site scriptingnpm · blitz
- CVE-2026-9497changmingxie tcc-transaction Fastjson AutoType REST API Fastjson.parseObject deserializationMaven · org.mengyun:tcc-transaction
- CVE-2026-9370ulisesbocchio jasypt-spring-boot Password Hash SimpleGCMConfig.java getSecretKeySaltGenerator hash predictable saltMaven · com.github.ulisesbocchio:jasypt-spring-boot, com.github.ulisesbocchio:jasypt-spring-boot-starter
- CVE-2026-3515Argument Injection in prefecthq/prefectPyPI · prefect