Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-40925WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP CredentialsPackagist · wwbn/avideo
- CVE-2026-40911WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() SinksPackagist · wwbn/avideo
- CVE-2026-40909WWBN AVideo has a Path Traversal in Locale Save Endpoint that Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)Packagist · wwbn/avideo
- CVE-2026-40908WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php that Exposes Developer Emails and Deployed VersionPackagist · wwbn/avideo
- CVE-2026-40907WWBN AVideo has IDOR in Live Restreams list.json.php that Exposes Other Users' Stream Keys and OAuth TokensPackagist · wwbn/avideo
- CVE-2026-6745Bagisto Custom Scripts cross site scriptingPackagist · bagisto/bagisto
- CVE-2026-6744Bagisto Downloadable Link copy server-side request forgeryPackagist · bagisto/bagisto
- CVE-2026-31018In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to Packagist · dolibarr/dolibarr
- CVE-2026-31019In the Website module of Dolibarr ERP & CRM 22.0.4 and below, the application uses blacklist-based filtering to restrict dangerous PHP functPackagist · dolibarr/dolibarr
- CVE-2026-33626LMDeploy Vulnerable to Server-Side Request Forgery (SSRF) via Vision-Language Image LoadingPyPI · lmdeploy
- CVE-2026-6634usememos UpdateInstanceSetting App.tsx memos_access_token improper authorizationGo · github.com/usememos/memos
- CVE-2026-6608lm-sys fastchat Arena Side-by-Side View add_text control flowPyPI · fschat
- CVE-2026-6607lm-sys fastchat Worker API Endpoint api_generate resource consumptionPyPI · fschat
- CVE-2026-6606modelscope agentscope _agent_base.py _process_audio_block server-side request forgeryPyPI · agentscope
- CVE-2026-6605modelscope agentscope Internal Service _common.py _get_bytes_from_web_url server-side request forgeryPyPI · agentscope
- CVE-2026-6604modelscope agentscope Cloud Metadata Endpoint _openai_tools.py openai_audio_to_text server-side request forgeryPyPI · agentscope
- CVE-2026-6603modelscope agentscope _python.py execute_shell_command code injectionPyPI · agentscope
- CVE-2026-6599langflow-ai langflow Model Context Protocol Configuration API mcp_projects.py install_mcp_config injectionPyPI · langflow
- CVE-2026-6597langflow-ai langflow Flow Using API core.py has_api_terms credentials storagePyPI · langflow
- CVE-2026-6594brikcss merge prototype pollutionnpm · @brikcss/merge
- CVE-2026-6587vibrantlabsai RAGAS Collections util.py _try_process_url server-side request forgeryPyPI · ragas
- CVE-2026-40474wger has Broken Access Control in the Global Gym Configuration Update EndpointPyPI · wger
- CVE-2026-40353wger: Stored XSS via Unescaped License Attribution FieldsPyPI · wger
- CVE-2026-23500Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configurationPackagist · dolibarr/dolibarr
- CVE-2026-5807Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey OperationsGo · github.com/hashicorp/vault
- CVE-2026-4525Vault Token Leaked to Backends via Authorization: Bearer Passthrough HeaderGo · github.com/hashicorp/vault
- CVE-2026-5052Vault Vulnerable to Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNSGo · github.com/hashicorp/vault
- CVE-2026-3605Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-ServiceGo · github.com/hashicorp/vault
- CVE-2026-31317Craftql v1.3.7 and before is vulnerable to Server-Side Request Forgery (SSRF) which allows an attacker to execute arbitrary code via the venPackagist · markhuot/craftql
- CVE-2026-40249free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errorsGo · github.com/free5gc/udr