Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-7150dh1011 auto-favicon MCP Tool server.py generate_favicon_from_url server-side request forgeryPyPI · auto-favicon
- CVE-2026-7149dexhunter kaggle-mcp server.py prepare_kaggle_dataset path traversalPyPI · kaggle-mcp
- CVE-2026-7045baomidou dynamic-datasource StandardEvaluationContext/SpelExpressionParser DsSpelExpressionProcessor.java DsSpelExpressionProcessor#doDetermineDatasource injectionMaven · com.baomidou:dynamic-datasource-spring
- CVE-2026-7020Ollama Tensor Model Transfer transfer.go digestToPath path traversalGo · github.com/ollama/ollama
- CVE-2026-6993go-kratos http.DefaultServeMux Fallback server.go NewServer confused deputyGo · github.com/go-kratos/kratos/v2
- CVE-2026-6987PicoClaw Web Launcher Management Plane restart command injectionGo · github.com/sipeed/picoclaw
- CVE-2026-6984AstrBotDevs AstrBot Dashboard API t2i.py create_template special elements used in a template enginePyPI · astrbot
- CVE-2026-41428Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpointsnpm · @budibase/backend-core
- CVE-2026-25660Authentication bypass for certain API callsPyPI · codechecker
- CVE-2026-41068Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix)Go · github.com/kyverno/kyverno
- CVE-2026-41078OpenTelemetry dotnet: Potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion pathNuGet · opentelemetry.exporter.jaeger
- CVE-2026-6878ByteDance verl grader.py math_equal sandboxPyPI · verl
- CVE-2026-6874ericc-ch copilot-api Header token dns rebindingnpm · copilot-api
- CVE-2026-40937RustFS missing admin authorization on notification target endpoints, which allows unauthenticated configuration of event webhookscrates.io · rustfs
- CVE-2026-34068nimiq-transaction: UpdateValidator transactions allows voting key change without proof-of-knowledgecrates.io · nimiq-transaction
- CVE-2026-34067nimiq-transaction vulnerable to panic via `HistoryTreeProof` length mismatchcrates.io · nimiq-transaction
- CVE-2026-34066nimiq-blockchain: Peer-triggerable panic during history synccrates.io · nimiq-blockchain
- CVE-2026-34065nimiq-primitives: Node crash due to missing interlink validation in election macro block proposalscrates.io · nimiq-primitives
- CVE-2026-34064nimiq-account: Vesting insufficient funds error can paniccrates.io · nimiq-account
- CVE-2026-35377uutils coreutils env Local Denial of Service via Improper Handling of Backslashes in Split-String Modecrates.io · coreutils
- CVE-2026-35376uutils coreutils chcon Security Bypass and Mandatory Access Control (MAC) Inconsistency via TOCTOU Race Conditioncrates.io · coreutils
- CVE-2026-35374uutils coreutils split Arbitrary File Truncation via Time-of-Check to Time-of-Use (TOCTOU) Race Conditioncrates.io · coreutils
- CVE-2026-35368uutils coreutils chroot Local Privilege Escalation and chroot Escape in via Name Service Switch (NSS) Injectioncrates.io · coreutils
- CVE-2026-35367uutils coreutils nohup Information Disclosure via Insecure Default Output Permissionscrates.io · coreutils
- CVE-2026-35364uutils coreutils mv Arbitrary File Overwrite via Cross-Device TOCTOU Race Conditioncrates.io · coreutils
- CVE-2026-35360uutils coreutils touch Arbitrary File Truncation via TOCTOU Race Conditioncrates.io · coreutils
- CVE-2026-35359uutils coreutils cp Information Disclosure via Time-of-Check to Time-of-Use Symlink Swapcrates.io · coreutils
- CVE-2026-35357uutils coreutils cp Information Disclosure via Permission Handling Racecrates.io · coreutils
- CVE-2026-35354uutils coreutils mv Security Xattr TOCTOU Race in Cross-Devicecrates.io · coreutils
- CVE-2026-35352uutils coreutils mkfifo Privilege Escalation via TOCTOU Race Conditioncrates.io · coreutils