Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-34739AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.phpPackagist · wwbn/avideo
- CVE-2026-34738AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request ParameterPackagist · wwbn/avideo
- CVE-2026-34737AVideo: Arbitrary Stripe Subscription Cancellation via Debug Endpoint and retrieveSubscriptions() BugPackagist · wwbn/avideo
- CVE-2026-34733AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI GuardPackagist · wwbn/avideo
- CVE-2026-34732AVideo: Missing Authentication in CreatePlugin list.json.php Template Affects 21 EndpointsPackagist · wwbn/avideo
- CVE-2026-34731AVideo: Unauthenticated Live Stream Termination via RTMP Callback on_publish_done.phpPackagist · wwbn/avideo
- CVE-2026-34716AVideo: DOM XSS via Unsanitized Display Name in WebSocket Call NotificationPackagist · wwbn/avideo
- CVE-2026-34613AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security PluginsPackagist · wwbn/avideo
- CVE-2026-34611AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All UsersPackagist · wwbn/avideo
- CVE-2026-34396AVideo: Stored XSS via Unescaped Plugin Configuration Values in Admin PanelPackagist · wwbn/avideo
- CVE-2026-34394AVideo: CSRF on Admin Plugin Configuration Enables Payment Credential HijackingPackagist · wwbn/avideo
- CVE-2026-34395AVideo: Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.phpPackagist · wwbn/avideo
- CVE-2026-34204MinIO is Vulnerable to SSE Metadata Injection via Replication HeadersGo · github.com/minio/minio
- CVE-2026-33027Nginx UI: Improper Path Validation Allows Recursive Deletion of the Nginx Configuration DirectoryGo · github.com/0xjacky/nginx-ui
- CVE-2026-33029Nginx UI: DoS via Negative Integer Input in Logrotate IntervalGo · github.com/0xjacky/nginx-ui
- CVE-2026-33030Nginx UI: Unencrypted Storage of DNS API Tokens and ACME Private KeysGo · github.com/0xjacky/nginx-ui
- CVE-2026-33032Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx TakeoverGo · github.com/0xjacky/nginx-ui
- CVE-2026-33992pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata ExfiltrationPyPI · pyload-ng
- CVE-2026-33980Azure Data Explorer MCP Server: KQL Injection in multiple tools allows MCP client to execute arbitrary Kusto queriesPyPI · adx-mcp-server
- CVE-2026-34375AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment PagePackagist · wwbn/avideo
- CVE-2026-34369AVIdeo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password VerificationPackagist · wwbn/avideo
- CVE-2026-34368AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalancePackagist · wwbn/avideo
- CVE-2026-34364AVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.phpPackagist · wwbn/avideo
- CVE-2026-4963huggingface smolagents Incomplete Fix CVE-2025-9959 local_python_executor.py evaluate_with code injectionPyPI · smolagents
- CVE-2026-34362AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket()Packagist · wwbn/avideo
- CVE-2026-34247AVideo's IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False Socket NotificationsPackagist · wwbn/avideo
- CVE-2026-34245AVideo's Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast HijackingPackagist · wwbn/avideo
- CVE-2026-33867AVideo has Plaintext Video Password StoragePackagist · wwbn/avideo
- CVE-2025-15381Unauthorized Access to Tracing and Assessment Endpoints in mlflow/mlflowPyPI · mlflow
- CVE-2026-33770AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id VariablesPackagist · wwbn/avideo