Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-30048A stored cross-site scripting (XSS) vulnerability exists in the NotChatbot WebChat widget thru 1.4.4.npm · @developer.notchatbot/webchat
- CVE-2026-4229vanna-ai vanna bigquery_vector.py remove_training_data sql injectionPyPI · vanna
- CVE-2026-32774Vulnogram - Stored Cross-Site Scripting via Comment Hypertextnpm · vulnogram
- CVE-2026-31886Dagu has a Path Traversal via `dagRunId` in Inline DAG ExecutionGo · github.com/dagu-org/dagu
- CVE-2026-2366Keycloak: keycloak: information disclosure via authorization bypass in admin apinpm · @keycloak/keycloak-admin-client
- CVE-2026-3429Org.keycloak.services.resources.account: improper access control leading to mfa deletion and account takeover in keycloak account rest apiMaven · org.keycloak:keycloak-services
- CVE-2026-3911Org.keycloak.services.resources.admin.userresource: keycloak: information disclosure of disabled user attributes via administrative endpointMaven · org.keycloak:keycloak-services
- CVE-2026-26330Envoy global rate limit may crash when the response phase limit is enabled and the response phase request is failed directlyGo · github.com/envoyproxy/envoy
- CVE-2026-26311Envoy HTTP: filter chain execution on reset streams causing UAF crashGo · github.com/envoyproxy/envoy
- CVE-2026-26310Crash for scoped ip address in Envoy during DNSGo · github.com/envoyproxy/envoy
- CVE-2026-26309Envoy has an off-by-one write in JsonEscaper::escapeString()Go · github.com/envoyproxy/envoy
- CVE-2026-1776Camaleon CMS AWS Uploader Authenticated Path Traversal Arbitrary File ReadRubyGems · camaleon-cms, camaleon_cms
- CVE-2026-30926SiYuan Note publish service authorization bypass allows low-privilege users to modify notebook contentGo · github.com/siyuan-note/siyuan/kernel
- CVE-2025-70050An issue pertaining to CWE-312: Cleartext Storage of Sensitive Information was discovered in lesspass lesspass v9.6.9 which allows attackersPyPI · lesspass
- CVE-2026-29781Sliver: Authenticated Nil-Pointer Dereference in HandlersGo · github.com/bishopfox/sliver
- CVE-2026-30244Plane: Unauthenticated Workspace Member Information DisclosurePyPI · plane
- CVE-2026-29073SiYuan: Direct SQL Query API accessible to Reader-level users enables unauthorized database accessGo · github.com/siyuan-note/siyuan/kernel
- CVE-2026-28787OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replaynpm · @oneuptime/common
- CVE-2026-28501WWBN AVideo: Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.phpPackagist · wwbn/avideo
- CVE-2026-28502WWBN AVideo: Authenticated Remote Code Execution via Unsafe Plugin ZIP ExtractionPackagist · wwbn/avideo
- CVE-2026-29093WWBN AVideo: Unauthenticated PHP session store exposed to host network via published memcached portPackagist · wwbn/avideo
- CVE-2026-26276Gogs: DOM-based XSS via milestone selectionGo · gogs.io/gogs
- CVE-2026-26196Gogs: Access tokens get exposed through URL params in API requestsGo · gogs.io/gogs
- CVE-2026-26195Gogs: Stored XSS in branch and wiki views through author and committer namesGo · gogs.io/gogs
- CVE-2026-3047Org.keycloak.broker.saml: keycloak saml broker: authentication bypass due to disabled saml client completing idp-initiated loginMaven · org.keycloak:keycloak-broker-saml
- CVE-2025-70948A host header injection vulnerability in the mailer component of @perfood/couch-auth v0.26.0 allows attackers to obtain reset tokens and exenpm · @perfood/couch-auth
- CVE-2025-70949An observable timing discrepancy in @perfood/couch-auth v0.26.0 allows attackers to access sensitive information via a timing side-channel.npm · @perfood/couch-auth
- CVE-2026-0847Path Traversal in nltk/nltkPyPI · nltk
- CVE-2026-27012Unauthenticated privilege escalation in OpenSTAManager via modules/utenti/actions.phpPackagist · devcode-it/openstamanager
- CVE-2026-3484PhialsBasement nmap-mcp-server Nmap CLI index.ts child_process.exec command injectionnpm · mcp-nmap-server