Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-41147NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request classPackagist · nukeviet/nukeviet
- CVE-2026-40092nimiq-keys: Unchecked Ed25519 signature length in TaggedPublicKey::verify causes remote node panic via DHTcrates.io · nimiq-keys
- CVE-2026-26028CryptPad: Sanitizer Bypass in Diffmarked.js Allows Arbitrary HTML Injection and Potential XSSnpm · cryptpad
- CVE-2026-30691Cross-Site Scripting (XSS) vulnerability in @cyntler/react-doc-viewer v1.17.1 allows remote attackers to execute arbitrary JavaScript via a npm · @cyntler/react-doc-viewer
- CVE-2026-8922Org.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: security flaw in org.keycloak/keycloak-servicesMaven · org.keycloak:keycloak-services
- CVE-2025-70950An issue in gohttp commit 34ea51 allows attackers to execute a directory traversal via supplying a crafted request.Go · github.com/itang/gohttp
- CVE-2026-31069BillaBear (all versions prior to Jan 2026) contains a SQL Injection vulnerability in the EventRepository.Packagist · billabear/billabear
- CVE-2026-31072The JSONSerializer and CBORSerializer in APScheduler (all versions including 3.10.x and 4.0.0a5) are vulnerable to Remote Code Execution (RCPyPI · apscheduler
- CVE-2026-27891Remote Code Execution (RCE) via Zip Slip in Plugin Upload MechanismPackagist · facturascripts/facturascripts
- CVE-2026-45829A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attackPyPI · chromadb
- CVE-2026-7304CVE-2026-7304PyPI · sglang
- CVE-2026-7302CVE-2026-7302PyPI · sglang
- CVE-2026-7301CVE-2026-7301PyPI · sglang
- CVE-2025-57282ngrok v4.3.3 and 5.0.0-beta.2 is vulnerable to Command Injection.npm · ngrok
- CVE-2026-8771linlinjava litemall Front-end WeChat API WxGoodsController.java list sql injectionMaven · org.linlinjava:litemall-wx-api
- CVE-2026-8766Kilo-Org kilocode Environment Variable config.ts load information disclosurenpm · @kilocode/cli
- CVE-2026-8759xiandafu beetl SpELFunction SpELFunction.java expression language injectionMaven · com.ibeetl:beetl-spring-classic
- CVE-2026-23695Cockpit CMS 2.14.0 Stored XSS via Set Field Display TemplatePackagist · cockpit-hq/cockpit
- CVE-2026-44588SiYuan: URL-encoded title bypasses `escapeAriaLabel`, decoded by `decodeURIComponent` into a tooltip-XSSGo · github.com/siyuan-note/siyuan/kernel
- CVE-2026-45375SiYuan: Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code executionGo · github.com/siyuan-note/siyuan/kernel
- CVE-2026-42590Gotenberg: ExifTool group-prefix syntax bypasses dangerous-tag blocklistGo · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8
- CVE-2026-42593Gotenberg: Arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routesGo · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8
- CVE-2026-42592Gotenberg: DNS rebinding bypasses SSRF validation on Chromium URL conversion routesGo · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8
- CVE-2026-42591Gotenberg: Server-Side Request Forgery (SSRF) in github.com/gotenberg/gotenberg/v8Go · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8
- CVE-2026-40893Gotenberg: ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names Allows Arbitrary File Rename and MoveGo · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8
- CVE-2026-42589Gotenberg: Unauthenticated RCE via ExifTool Metadata Key InjectionGo · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8
- CVE-2026-44919In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can occur via the file:///PyPI · ironic
- CVE-2026-44364misp-modules website - Missing CSRF protection in the website home blueprintPyPI · misp-modules
- CVE-2026-44015Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal ServicesGo · github.com/0xjacky/nginx-ui
- CVE-2026-43929ssrfcheck: Server-Side Request Forgery (SSRF) and Incomplete List of Disallowed Inputsnpm · ssrfcheck