Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-42045LobeHub: Cross-Site Scripting(XSS) escalate to Remote Code Execution(RCE)npm · @lobehub/lobehub
- CVE-2026-31220PySyft (Syft Datasite/Server) versions 0.9.5 and earlier are vulnerable to remote code execution due to insufficient validation and sandboxiPyPI · syft
- CVE-2026-31221PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability (CWE-502) in the checkpoint loading mechanismPyPI · lightning, pytorch-lightning
- CVE-2026-31222The snorkel library thru v0.10.0 contains an insecure deserialization vulnerability (CWE-502) in the Trainer.load() method of the Trainer clPyPI · snorkel
- CVE-2026-31223The snorkel library thru v0.10.0 contains a critical insecure deserialization vulnerability (CWE-502) in the BaseLabeler.load() method of thPyPI · snorkel
- CVE-2026-31224The snorkel library thru v0.10.0 contains an insecure deserialization vulnerability (CWE-502) in the MultitaskClassifier.load() method of thPyPI · snorkel
- CVE-2026-31225The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component.PyPI · superduper-framework
- CVE-2026-31233Guardrails AI thru 0.6.7 contains a code injection vulnerability (CWE-94) in its Hub package installation mechanism.PyPI · guardrails-ai
- CVE-2026-31234Horovod thru 0.28.1 contains an insecure deserialization vulnerability (CWE-502) in its KVStore HTTP server component.PyPI · horovod
- CVE-2026-31235The imgaug library thru 0.4.0 contains an insecure deserialization vulnerability in its BackgroundAugmenter class within the multicore.py moPyPI · imgaug
- CVE-2026-31236The llm CLI tool thru 0.27.1 contains a critical code injection vulnerability via its --functions command-line argument.PyPI · llm
- CVE-2026-31237The Ludwig framework thru 0.10.4 is vulnerable to insecure deserialization (CWE-502) through its predict() method.PyPI · ludwig
- CVE-2026-31238The Ludwig framework thru 0.10.4 is vulnerable to insecure deserialization (CWE-502) in its model serving component.PyPI · ludwig
- CVE-2026-31239The mamba language model framework thru 2.2.6 is vulnerable to insecure deserialization (CWE-502) when loading pre-trained models from HuggiPyPI · mamba-ssm
- CVE-2026-31240The mem0 1.0.0 server lacks authentication and authorization controls for its memory management API endpoints.PyPI · mem0ai
- CVE-2026-31241The mem0 1.0.0 server lacks authentication and authorization controls for its memory deletion API endpoint (DELETE /memories).PyPI · mem0ai
- CVE-2026-31245The mem0 1.0.0 server lacks authentication and authorization controls for its memory creation API endpoint (POST /memories).PyPI · mem0ai
- CVE-2026-8349omec-project amf NGAP Message memory corruptionGo · github.com/omec-project/amf
- CVE-2026-43901Wireshark MCP: Arbitrary file write via export_objects when WIRESHARK_MCP_ALLOWED_DIRS is not configuredPyPI · wireshark-mcp
- CVE-2026-43885WWBN AVideo: Exposure of Sensitive Information to an Unauthorized Actor and Missing AuthorizationPackagist · wwbn/avideo
- CVE-2026-43884WWBN AVideo: SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()Packagist · wwbn/avideo
- CVE-2026-43883WWBN AVideo: IDOR in PayPalYPT agreementCancel.json.php Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription AgreementsPackagist · wwbn/avideo
- CVE-2026-43882WWBN AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event SpoofingPackagist · wwbn/avideo
- CVE-2026-43881WWBN AVideo: Unauthenticated User Enumeration in `objects/users.json.php` via `isCompany` Parameter Flips `$ignoreAdmin = true` and Defeats Admin-Only Listing GuardPackagist · wwbn/avideo
- CVE-2026-43880WWBN AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Allows Phishing from Site's Legitimate From AddressPackagist · wwbn/avideo
- CVE-2026-43879WWBN AVideo: Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect BypassPackagist · wwbn/avideo
- CVE-2026-43878WWBN AVideo: Reflected XSS in plugin/Meet/iframe.php via Unescaped `user`/`pass` Parameters Reflected into JavaScript String LiteralPackagist · wwbn/avideo
- CVE-2026-43877WWBN AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Any Logged-in User's Profile Photo with Arbitrary BytesPackagist · wwbn/avideo
- CVE-2026-43876WWBN AVideo: HTML Injection in notifySubscribers.json.php Enables Platform-Branded Phishing Emails to Channel SubscribersPackagist · wwbn/avideo
- CVE-2026-43875WWBN AVideo: Password Hash Leaked in MobileManager OAuth Redirect URL Enables Account TakeoverPackagist · wwbn/avideo