Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-4587HybridAuth SSL Curl.php certificate validationPackagist · hybridauth/hybridauth
- CVE-2026-4628Keycloak: org.keycloak.authorization: keycloak: unauthorized resource modification due to improper access controlMaven · org.keycloak:keycloak-services
- CVE-2026-24516A command injection vulnerability exists in DigitalOcean Droplet Agent through 1.3.2.Go · github.com/digitalocean/droplet-agent
- CVE-2026-33296AVideo has an Open Redirect via Unvalidated redirectUri in userLogin.phpPackagist · wwbn/avideo
- CVE-2026-33295AVideo Vulnerable to Stored XSS via Unescaped Video Title in CDN downloadButtons.phpPackagist · wwbn/avideo
- CVE-2026-33294AVideo has SSRF in BulkEmbed Thumbnail Fetch that Allows Reading Internal Network ResourcesPackagist · wwbn/avideo
- CVE-2026-33293AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump ParameterPackagist · wwbn/avideo
- CVE-2026-33319AVideo Vulnerable to OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell CommandPackagist · wwbn/avideo
- CVE-2026-33292AVideo has Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid VideosPackagist · wwbn/avideo
- CVE-2026-4538PyTorch pt2 Loading deserializationPyPI · torch
- CVE-2019-25586Deluge 1.3.15 Denial of Service via URL FieldPyPI · deluge
- CVE-2019-25585Deluge 1.3.15 Denial of Service via Webseeds FieldPyPI · deluge
- CVE-2026-33226Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Previewnpm · budibase
- CVE-2026-33476SiYuan has an Unauthenticated Arbitrary File Read via Path TraversalGo · github.com/siyuan-note/siyuan/kernel
- CVE-2026-4506Mindinventory MindSQL mindsql_core.py ask_db code injectionPyPI · mindsql
- CVE-2026-33043AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORSPackagist · wwbn/avideo
- CVE-2026-33041AVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.phpPackagist · wwbn/avideo
- CVE-2026-33039AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxyPackagist · wwbn/avideo
- CVE-2026-33038AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deploymentsPackagist · wwbn/avideo
- CVE-2026-33035Unauthenticated Reflected XSS via innerHTML in AVideoPackagist · wwbn/avideo
- CVE-2026-32941Sliver Vulnerable to Authenticated OOM via Memory Exhaustion in mTLS/WireGuard TransportsGo · github.com/bishopfox/sliver
- CVE-2026-32940SiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183)Go · github.com/siyuan-note/siyuan
- CVE-2026-32938SiYuan has an Arbitrary File Read in its Desktop Publish ServiceGo · github.com/siyuan-note/siyuan/kernel
- CVE-2026-32767SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search APIGo · github.com/siyuan-note/siyuan/kernel
- CVE-2026-32815SiYuan: Cross-Origin WebSocket Hijacking via Authentication Bypass — Unauthenticated Information DisclosureGo · github.com/siyuan-note/siyuan/kernel
- CVE-2026-32750SiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notesGo · github.com/siyuan-note/siyuan
- CVE-2026-32751SiYuan Vulnerable to Remote Code Execution via Stored XSS in Notebook Name - Mobile InterfaceGo · github.com/siyuan-note/siyuan/kernel
- CVE-2026-32749SiYuan importSY/importZipMd: Path Traversal via multipart filename enables arbitrary file writeGo · github.com/siyuan-note/siyuan/kernel
- CVE-2026-32747SiYuan: Incomplete sensitive path blocklist in globalCopyFiles allows reading /proc and Docker secretsGo · github.com/siyuan-note/siyuan/kernel
- CVE-2026-2092Keycloak-services: keycloak: unauthorized access via improper validation of encrypted saml assertionsMaven · org.keycloak:keycloak-services