Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-35351uutils coreutils mv Silent Ownership Loss in Cross-Device Operationscrates.io · coreutils
- CVE-2026-35350uutils coreutils cp Unexpected Privileged Executable Creation with -pcrates.io · coreutils
- CVE-2026-35348uutils coreutils sort Local Denial of Service via Forced UTF-8 Parsingcrates.io · coreutils
- CVE-2026-35345uutils coreutils tail Privileged Information Disclosure via Symlink Replacement Racecrates.io · coreutils
- CVE-2026-35344uutils coreutils dd Silent Data Corruption via Unconditional Truncation Error Suppressioncrates.io · coreutils
- CVE-2026-6859Instructlab: instructlab: arbitrary code execution due to hardcoded `trust_remote_code=true`PyPI · instructlab
- CVE-2026-6855Instructlab: instructlab: path traversal allows arbitrary directory creation and file writePyPI · instructlab
- CVE-2026-41146facil.io and downstream iodine ruby gem vulnerable to uncontrolled resource consumption and loop with unreachable exit conditionRubyGems · iodine
- CVE-2026-41145MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer UploadsGo · github.com/minio/minio
- CVE-2026-40344MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer UploadsGo · github.com/minio/minio
- CVE-2026-30139A reflected cross-site scripting (XSS) vulnerability in the AdvancedSearch functionality of Silverpeas Core before version 6.4.6 allows attaMaven · org.silverpeas.core:silverpeas-core-war, org.silverpeas.core:silverpeas-core-web
- CVE-2026-41136free5GC AMF missing default case in Content-Type switch in HTTPUEContextTransferGo · github.com/free5gc/amf
- CVE-2026-40343free5GC UDR: Fail-open handling in PolicyDataSubsToNotifyPost allows unintended subscription creationGo · github.com/free5gc/udr
- CVE-2026-41133pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)PyPI · pyload-ng
- CVE-2026-41304WWBN AVideo vulnerable to RCE caused by clonesite pluginPackagist · wwbn/avideo
- CVE-2026-41064AVideo has an incomplete fix for CVE-2026-33502 (Command Injection)Packagist · wwbn/avideo
- CVE-2026-41063WWBN AVideo has incomplete fix for CVE-2026-33500 (XSS)Packagist · wwbn/avideo
- CVE-2026-41062WWBN/AVideo has an incomplete fix for a directory traversal bypass via query string in ReceiveImage downloadURL parametersPackagist · wwbn/avideo
- CVE-2026-41061WWBN AVideo Vulnerable to stored XSS via Unanchored Duration Regex in Video Encoder ReceiverPackagist · wwbn/avideo
- CVE-2026-41060AVideo's SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURLPackagist · wwbn/avideo
- CVE-2026-41058AVideo has an incomplete fix for CVE-2026-33293 (Path Traversal) in AVideoPackagist · wwbn/avideo
- CVE-2026-41057AVideo has CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) that Exposes Authenticated API ResponsesPackagist · wwbn/avideo
- CVE-2026-41056AVideos has CORS Origin Reflection with Credentials on Sensitive API Endpoints that Enables Cross-Origin Account TakeoverPackagist · wwbn/avideo
- CVE-2026-41055AVideo has an incomplete fix for CVE-2026-33039 (SSRF)Packagist · wwbn/avideo
- CVE-2026-40935WWBN/AVideo has CAPTCHA Bypass via Attacker-Controlled Length Parameter and Missing Token Invalidation on FailurePackagist · wwbn/avideo
- CVE-2026-40929WWBN AVideo's missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creatorsPackagist · wwbn/avideo
- CVE-2026-40928AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset DeletionPackagist · wwbn/avideo
- CVE-2026-40926WWBN AVideo Vulnerable to CSRF in Admin JSON Endpoints (Category CRUD, Plugin Update Script)Packagist · wwbn/avideo
- CVE-2026-40942DSF: Inverted Time Comparison in OIDC JWKS and Token CacheMaven · dev.dsf:dsf-bpe-process-api-v2, dev.dsf:dsf-bpe-server
- CVE-2026-40939DSF: Missing Session Timeout for OIDC SessionsMaven · dev.dsf:dsf-bpe-server, dev.dsf:dsf-common-jetty +1