Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-28518OpenViking .ovpack Import ZIP Slip Path TraversalPyPI · openviking
- CVE-2026-2256Command injection vulnerability in ModelScope's ms-agentPyPI · ms-agent
- CVE-2026-28268Vikunja Vulnerable to Account Takeover via Password Reset Token ReuseGo · code.vikunja.io/api
- CVE-2026-3293snowflakedb snowflake-jdbc JDBC URL SdkProxyRoutePlanner.java SdkProxyRoutePlanner redosMaven · net.snowflake:snowflake-jdbc
- CVE-2026-3270psi-probe PSI Probe Whois Whois.java lookup server-side request forgeryMaven · com.github.psi-probe:psi-probe-core
- CVE-2026-3269psi-probe PSI Probe Session ExpireSessionsController.java handleRequestInternal denial of serviceMaven · com.github.psi-probe:psi-probe-core
- CVE-2026-27839wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookupPyPI · wger
- CVE-2026-27838wger: IDOR via user-unscoped cache keys on routine API actions exposes workout dataPyPI · wger
- CVE-2026-27835wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout dataPyPI · wger
- CVE-2026-27966Langflow has Remote Code Execution in CSV AgentPyPI · langflow
- CVE-2026-27819Vikunja has Path Traversal in CLI RestoreGo · code.vikunja.io/api
- CVE-2026-27616Vikunja Vulnerable to Stored Cross-Site Scripting (XSS) via Unsanitized SVG Attachment Upload Leading to Token ExposureGo · code.vikunja.io/api
- CVE-2026-27575Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password ChangeGo · code.vikunja.io/api
- CVE-2026-27116Vikunja has Reflected HTML Injection via filter Parameter in Projects ModuleGo · code.vikunja.io/api
- CVE-2026-22866ENS DNSSEC Oracle Vulnerable to RSA Signature Forgery via Missing PKCS#1 v1.5 Padding Validationnpm · @ensdomains/ens-contracts
- CVE-2026-27598Dagu: Path traversal in DAG creation allows arbitrary YAML file write outside DAGs directoryGo · github.com/dagu-org/dagu
- CVE-2025-69985FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE).npm · @frangoteam/fuxa
- CVE-2026-2970datapizza-labs datapizza-ai cache.py RedisCache deserializationPyPI · datapizza-ai-core
- CVE-2026-2969datapizza-labs datapizza-ai Jinja2 Template prompt.py ChatPromptTemplate special elements used in a template enginePyPI · datapizza-ai-core
- CVE-2025-70058An issue pertaining to CWE-295: Improper Certificate Validation was discovered in YMFE yapi v1.12.0.npm · yapi-vendor
- CVE-2026-2898funadmin Backend Endpoint AuthCloudService.php getMember deserializationPackagist · funadmin/funadmin
- CVE-2026-2897funadmin Backend index.html cross site scriptingPackagist · funadmin/funadmin
- CVE-2026-2896funadmin Configuration Ajax.php setConfig improper authorizationPackagist · funadmin/funadmin
- CVE-2026-2895funadmin Member.php repass password recoveryPackagist · funadmin/funadmin
- CVE-2026-2894funadmin forget.html getMember information disclosurePackagist · funadmin/funadmin
- CVE-2026-27203eBay API MCP Server Affected by Environment Variable Injectionnpm · ebay-mcp
- CVE-2026-2733Org.keycloak/keycloak-services: keycloak: missing check on disabled client for docker registry protocolMaven · org.keycloak:keycloak-services
- CVE-2026-2666mingSoft MCMS Template Archive uploadTemplate.do unrestricted uploadMaven · net.mingsoft:ms-mcms
- CVE-2026-2654huggingface smolagents LocalPythonExecutor requests.post server-side request forgeryPyPI · smolagents
- CVE-2026-24708An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1.PyPI · nova