Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-7847chatchat-space Langchain-Chatchat Uploaded File openai_routes.py _get_file_id random valuesPyPI · langchain-chatchat
- CVE-2026-7846chatchat-space Langchain-Chatchat OpenAI-Compatible File Upload API openai_routes.py files toctouPyPI · langchain-chatchat
- CVE-2026-7845chatchat-space Langchain-Chatchat Vision Chat Paste Image dialogue.py PIL.Image.tobytes weak hashPyPI · langchain-chatchat
- CVE-2026-43870Apache Thrift: Node.js web_server.js multi-vulnerabilitynpm · thrift
- CVE-2026-42222nginx-ui: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeoverGo · github.com/0xjacky/nginx-ui
- CVE-2026-42220nginx-ui: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and restore-based nginx-ui state rollbackGo · github.com/0xjacky/nginx-ui
- CVE-2026-6501Improper restriction of XML external entity reference vulnerability in ILM Informatique jOpenDocument allows Data Serialization External EntMaven · org.jopendocument:jopendocument
- CVE-2026-7738puchunjie doc-tools-mcp MCP mcp-server.ts open_document path traversalnpm · @puchunjie/doc-tools-mcp
- CVE-2026-7733funadmin Frontend Chunked Upload Endpoint UploadService.php chunkUpload unrestricted uploadPackagist · funadmin/funadmin
- CVE-2026-38751OpenSTAManager version 2.10 and earlier contains an arbitrary file upload vulnerability in the module update functionality…Packagist · devcode-it/openstamanager
- CVE-2026-7711MindsDB Engine proc_wrapper.py exec unrestricted uploadPyPI · mindsdb
- CVE-2026-7689Dolibarr ERP CRM Online Signature security.lib.php dol_verifyHash signature verificationPackagist · dolibarr/dolibarr
- CVE-2026-7688Dolibarr ERP CRM Shipments API Endpoint expedition.class.php _checkValForAPI sql injectionPackagist · dolibarr/dolibarr
- CVE-2026-7669sgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injectionPyPI · sglang
- CVE-2026-7645ruvnet sublinear-time-solver MCP server.js export_state path traversalnpm · sublinear-time-solver
- CVE-2026-7600ArtMin96 yii2-mcp-server MCP index.ts yii_execute_command os command injectionnpm · yii2-mcp-server
- CVE-2026-7579AstrBotDevs AstrBot Dashboard auth.py hard-coded credentialsPyPI · astrbot
- CVE-2026-42474SQL injection vulnerability in MixPHP Framework 2.x thru 2.2.17 via crafted `data` array to the data function in BuildHelper.php.Packagist · mix/mix
- CVE-2026-42475SQL injection vulnerability in MixPHP Framework 2.x thru 2.2.17 via crafted `on` array to the joinOn function in BuildHelper.php.Packagist · mix/mix
- CVE-2026-7500Org.keycloak.keycloak-services: improper access control on keycloak server when the account account api feature is disabledMaven · org.keycloak:keycloak-services
- CVE-2025-13030All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint.PyPI · django-mdeditor
- CVE-2026-36766Multiple authenticated cross-site scripting (XSS) vulnerabilities in the XssHttpServletRequestWrapper class of shopizer v3.2.5 allows attackMaven · com.shopizer:shopizer
- CVE-2026-36767A path traversal vulnerability in the /content/images/add endpoint of shopizer v3.2.5 allows attackers write arbitrary files to any writeablMaven · com.shopizer:shopizer
- CVE-2026-7404getsimpletool mcpo-simple-server base_manager.py delete_shared_prompt path traversalPyPI · mcpo-simple-server
- CVE-2026-7223BigSweetPotatoStudio HyperChat AI Proxy Middleware aiProxyMiddleware.mts fetch server-side request forgerynpm · @dadigua/hyperchat
- CVE-2026-7212edvardlindelof notes-mcp notes_mcp.py path traversalPyPI · notes-mcp
- CVE-2026-7206dubydu sqlite-mcp entry.py extract_to_json sql injectionPyPI · sqlite-mcp
- CVE-2026-7159douinc mkdocs-mcp-plugin server.py list_documents path traversalPyPI · mkdocs-mcp-plugin
- CVE-2026-7158dmitryglhf mcp-url-downloader server.py _validate_url_safe server-side request forgeryPyPI · mcp-url-downloader
- CVE-2026-5362Pimcore Platform v12.3.3 - Stored XSS in Document Editable Embed renderingPackagist · pimcore/pimcore