Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-35448WWBN AVideo Provides Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.phpPackagist · wwbn/avideo
- CVE-2026-35459pyLoad has SSRF fix bypass via HTTP redirectPyPI · pyload-ng
- CVE-2026-35187pyLoad has SSRF in parse_urls API endpoint via unvalidated URL parameterPyPI · pyload-ng
- CVE-2026-35181WWBN AVideo Affected by CSRF on Player Skin Configuration via admin/playerUpdate.json.phpPackagist · wwbn/avideo
- CVE-2026-35179WWBN AVideo Unauthenticated Instagram Graph API Proxy via publishInstagram.json.phpPackagist · wwbn/avideo
- CVE-2026-35042fast-jwt accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)npm · fast-jwt
- CVE-2026-34444Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattrPyPI · lupa
- CVE-2026-31313An authenticated stored cross-site scripting (XSS) vulnerability in the creation/editing module of Feehi CMS v2.1.1 allows attackers to execPackagist · feehi/cms
- CVE-2026-31350An authenticated stored cross-site scripting (XSS) vulnerability in Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTPackagist · feehi/cms
- CVE-2026-31351An authenticated stored cross-site scripting (XSS) vulnerability in the creation/editing module of Feehi CMS v2.1.1 allows attackers to execPackagist · feehi/cms
- CVE-2026-31352An authenticated stored cross-site scripting (XSS) vulnerability in the Role Management module of Feehi CMS v2.1.1 allows attackers to execuPackagist · feehi/cms
- CVE-2026-31353An authenticated stored cross-site scripting (XSS) vulnerability in the Category module of Feehi CMS v2.1.1 allows attackers to execute arbiPackagist · feehi/cms
- CVE-2026-31354Multiple authenticated stored cross-site scripting (XSS) vulnerabilities in the Permissions module of Feehi CMS v2.1.1 allows attackers to ePackagist · feehi/cms
- CVE-2026-5603elgentos magento2-dev-mcp index.ts executeMagerun2Command os command injectionnpm · @elgentos/magento2-dev-mcp
- CVE-2026-5602Nor2-io heim-mcp new_heim_application tools.ts registerTools os command injectionnpm · @nor2/heim-mcp
- CVE-2026-5559AntaresMugisho PyBlade AST Validation sandbox.py _is_safe_ast special elements used in a template enginePyPI · pyblade
- CVE-2016-20054Nodcms Cross Site Request Forgery via admin endpointsPackagist · khodakhah/nodcms
- CVE-2026-0545Missing Authentication for Critical Function in mlflow/mlflowPyPI · mlflow
- CVE-2026-5469Casdoor Webhook URL server-side request forgeryGo · github.com/casdoor/casdoor
- CVE-2026-5468Casdoor dangerouslySetInnerHTML cross site scriptingGo · github.com/casdoor/casdoor
- CVE-2026-28736Focalboard IDOR in file content endpoint allows cross-user file access (unsupported product, no fix)Go · github.com/mattermost/focalboard
- CVE-2026-25773Focalboard Second-Order SQL Injection in category reorder endpoint allows data exfiltration (unsupported product, no fix)Go · github.com/mattermost/focalboard
- CVE-2026-5467Casdoor OAuth Authorization Request redirectGo · github.com/casdoor/casdoor
- CVE-2026-5463pymetasploit3 - Command Injection via Newline Injection in console.run_module_with_output()PyPI · pymetasploit3
- CVE-2026-34581goshs has Auth Bypass via Share TokenGo · github.com/patrickhener/goshs
- CVE-2026-5370krayin laravel-crm Activities Module/Notes inbox.spec.ts composeMail cross site scriptingPackagist · krayin/laravel-crm
- CVE-2026-5327efforthye fast-filesystem-mcp index.ts handleGetDiskUsage command injectionnpm · fast-filesystem-mcp
- CVE-2026-2265Replicator 1.0.5 is vulnerable to Remote Code Execution through Insecure Deserializationnpm · replicator
- CVE-2026-4370Improper TLS Client/Server authentication and certificate verification on Database ClusterGo · github.com/juju/juju
- CVE-2026-34740AVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() ValidationPackagist · wwbn/avideo