Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-33766AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download EndpointsPackagist · wwbn/avideo
- CVE-2026-33764AVideo: IDOR in AI Plugin Allows Stealing Other Users' AI-Generated Metadata and TranscriptionsPackagist · wwbn/avideo
- CVE-2026-33763AVideo has an Unauthenticated Video Password Brute-Force Vulnerability via Unrate-Limited Boolean OraclePackagist · wwbn/avideo
- CVE-2026-33761AVideo: Unauthenticated Access to Scheduler Plugin Endpoints Leaks Scheduled Tasks, Email Content, and User MappingsPackagist · wwbn/avideo
- CVE-2026-33759AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist ContentsPackagist · wwbn/avideo
- CVE-2026-33670SiYuan has directory traversal within its publishing serviceGo · github.com/siyuan-note/siyuan/kernel
- CVE-2026-33669SiYuan has Arbitrary Document Reading within the Publishing ServiceGo · github.com/siyuan-note/siyuan/kernel
- CVE-2026-33622A PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript ExecutionGo · github.com/pinchtab/pinchtab, github.com/pinchtab/pinchtab/cmd/pinchtab
- CVE-2026-32286Denial of service in github.com/jackc/pgproto3/v2Go · github.com/jackc/pgproto3/v2
- CVE-2026-33285LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crashnpm · liquidjs
- CVE-2026-33287LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Patternnpm · liquidjs
- CVE-2026-26830pdf-image (npm package) through version 2.0.0 allows OS command injection via the pdfFilePath parameter.npm · pdf-image
- CVE-2026-26831textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors.npm · textract
- CVE-2026-26832node-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR.npm · node-tesseract-ocr
- CVE-2026-26833thumbler through 1.1.2 allows OS command injection via the input, output, time, or size parameter in the thumbnail() function because user inpm · thumbler
- CVE-2026-33419MinIO: LDAP login brute-force via user enumeration and missing rate limitGo · github.com/minio/minio
- CVE-2026-33322MinIO: JWT Algorithm Confusion in OIDC AuthenticationGo · github.com/minio/minio
- CVE-2026-33509pyload-ng: SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script ConfigurationPyPI · pyload-ng
- CVE-2026-33473Vikunja has TOTP Reuse During Validity WindowGo · code.vikunja.io/api
- CVE-2026-33316Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account DisablementGo · code.vikunja.io/api
- CVE-2026-33315Vikunja has a 2FA Bypass via Caldav Basic AuthGo · code.vikunja.io/api
- CVE-2026-33313Vikunja has an IDOR in Task Comments Allows Reading Arbitrary CommentsGo · code.vikunja.io/api
- CVE-2026-30662ConcreteCMS v9.4.7 contains a Denial of Service (DoS) vulnerability in the File Manager component.Packagist · concrete5/concrete5
- CVE-2026-33634Trivy ecosystem supply chain briefly compromisedGo · github.com/aquasecurity/trivy
- CVE-2026-32879New API has passkey-based secure step-up verification bypass for root-only channel secret disclosureGo · github.com/quantumnous/new-api
- CVE-2026-33723AVideo Vulnerable to SQL Injection in Subscribe Endpoint via Unsanitized user_id Parameter in subscribe.phpPackagist · wwbn/avideo
- CVE-2026-33719AVideo Vulnerable to Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment in status.json.phpPackagist · wwbn/avideo
- CVE-2026-33717AVideo Vulnerable to Remote Code Execution via Persistent PHP Temp File in Encoder downloadURL with Resolution Validation AbortPackagist · wwbn/avideo
- CVE-2026-33716AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.phpPackagist · wwbn/avideo
- CVE-2026-33690AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr()Packagist · wwbn/avideo