Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-43873WWBN AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone ServerPackagist · wwbn/avideo
- CVE-2026-43874WWBN AVideo: Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay BypassPackagist · wwbn/avideo
- CVE-2026-8319aiwaves-cn agents cheshire_cat_core stray_cat.py recall_relevant_memories_to_working_memory resource consumptionPyPI · ai-agents
- CVE-2026-6815CVE-2026-6815Go · github.com/casdoor/casdoor
- CVE-2026-30635Command injection vulnerability in automagik-genie 2.5.27 MCP Server allows attackers to execute arbitrary commands via the view_task (aka vnpm · automagik-genie
- CVE-2026-31246GPT-Pilot thru commit 0819827ce20346ef5f25b3fe29293cb448840565 (2025-09-03) contains a command injection vulnerability (CWE-78) in the ExecuPyPI · gpt-pilot
- CVE-2026-31247Docling's JATS XML backend is vulnerable to XML Entity Expansion (XXE) attacks thru 2.61.0.PyPI · docling
- CVE-2026-31248Docling's METS GBS backend is vulnerable to XML Entity Expansion (XXE) attacks thru 2.61.0.PyPI · docling
- CVE-2026-31253The flash-attention training framework thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains an insecure deserializatioPyPI · flash-attn
- CVE-2026-42601ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddViewPyPI · archivebox
- CVE-2026-42339New API: SSRF Filter Bypass via 0.0.0.0Go · github.com/quantumnous/new-api
- CVE-2026-43942electerm: Full process.env exposed to renderer via window.pre.env in electermnpm · electerm
- CVE-2026-43941Unvalidated shell.openExternal in electerm allows arbitrary protocol execution via terminal link clicknpm · electerm
- CVE-2026-38360Directory Traversal vulnerability in fohrloop dash-uploader v.0.1.0 through v.0.7.0a2 allows a remote attacker to execute arbitrary code viaPyPI · dash-uploader
- CVE-2026-8115gyoridavid short-video-maker REST API rest.ts path traversalnpm · short-video-maker
- CVE-2026-44742Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wildPyPI · postorius
- CVE-2026-41685Incus: Unbounded binary import disk exhaustionGo · github.com/lxc/incus, github.com/lxc/incus/v6 +1
- CVE-2026-41684Incus: Nil Dereferences on Restore via Malformed YAMLGo · github.com/lxc/incus, github.com/lxc/incus/v6 +1
- CVE-2026-41648Incus: Unbounded YAML Metadata Decode via ParsingGo · github.com/lxc/incus, github.com/lxc/incus/v6 +1
- CVE-2026-41647Incus: Nil-Pointer Dereference via S3 Bucket ImportGo · github.com/lxc/incus, github.com/lxc/incus/v6 +1
- CVE-2026-41586ObjectInputStream.readObject() without ObjectInputFilter in fabric-sdk-java allows Java deserialization RCEMaven · org.hyperledger.fabric-sdk-java:fabric-sdk-java
- CVE-2025-63703npm package parse-ini v1.0.6 is vulnerable to Prototype Pollution in index.js().npm · parse-ini
- CVE-2025-63704NPM package query-parser-string 1.0.0 is vulnerable to Prototype Pollution.npm · query-string-parser
- CVE-2025-63705NPM package node-ts-ocr 1.0.15 is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js.npm · node-ts-ocr
- CVE-2025-63706NPM package next-npm-version1.0.1 is vulnerable to Command injection.npm · @jswork/next-npm-version
- CVE-2025-65122Regex Denial of Service in youtube-regex npm package through version 1.0.5.npm · youtube-regex
- CVE-2026-40076OpenMRS Core arbitrary file write and code execution via Zip Slip in module uploadMaven · org.openmrs.web:openmrs-web
- CVE-2026-8026FlowiseAI Flowise API Response account.service.ts login information disclosurenpm · flowise
- CVE-2026-44405In Paramiko through 4.0.0 before a448945, rsakey.py allows the SHA-1 algorithm.PyPI · paramiko
- CVE-2026-32699FacturaScripts unauthorized modification of immutable nick field via EditUser controllerPackagist · facturascripts/facturascripts