Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-25338Dokuwiki 2018-04-22b - Username EnumerationPyPI · dokuwiki
- CVE-2026-26056Arbitrary WASM Code Execution via AnnotationOverrideFlight Injection in Yoke ATCGo · github.com/yokecd/yoke
- CVE-2026-26055Unauthenticated Admission Webhook Endpoints in Yoke ATCGo · github.com/yokecd/yoke
- CVE-2026-25935Vikunja Affected by XSS Via Task PreviewGo · code.vikunja.io/api
- CVE-2018-25157Phraseanet 4.0.3 Stored XSS via Document UploadPackagist · phraseanet/phraseanet
- CVE-2025-69872DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default.PyPI · diskcache
- CVE-2025-69874nanotar through 0.2.0 has a path traversal vulnerability in parseTar() and parseTarGzip() that allows remote attackers to write arbitrary finpm · nanotar
- CVE-2026-25992SiYuan has a File Read Interface Case Bypass VulnerabilityGo · github.com/siyuan-note/siyuan/kernel
- CVE-2026-25905Lack of isolation in mcp-run-python leads to MCP server takeoverPyPI · mcp-run-python
- CVE-2026-25904Overly permissive Deno configuration in mcp-run-python leads to SSRFPyPI · mcp-run-python
- CVE-2026-2178r-huijts xcode-mcp-server run_lldb index.ts registerXcodeTools command injectionnpm · xcode-mcp-server
- CVE-2025-69212OpenSTAManager has an OS Command Injection in P7M File ProcessingPackagist · devcode-it/openstamanager
- CVE-2025-69214OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)Packagist · devcode-it/openstamanager
- CVE-2025-69216OpenSTAManager has an SQL Injection in Scadenzario Print TemplatePackagist · devcode-it/openstamanager
- CVE-2026-24416OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing ModulePackagist · devcode-it/openstamanager
- CVE-2026-24417OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of ServicePackagist · devcode-it/openstamanager
- CVE-2026-24418OpenSTAManager has an SQL Injection vulnerability in the Scadenzario bulk operations modulePackagist · devcode-it/openstamanager
- CVE-2026-24419OpenSTAManager has an SQL Injection in the Prima Nota modulePackagist · devcode-it/openstamanager
- CVE-2025-70963Gophish <=0.12.1 is vulnerable to Incorrect Access Control.Go · github.com/gophish/gophish
- CVE-2026-25539SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCEGo · github.com/siyuan-note/siyuan/kernel
- CVE-2026-25538Devtron Attributes API Unauthorized Access Leading to API Token Signing Key LeakageGo · github.com/devtron-labs/devtron
- CVE-2025-69215OpenSTAManager has an SQL Injection in the Stampe ModulePackagist · devcode-it/openstamanager
- CVE-2025-69213OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint)Packagist · devcode-it/openstamanager
- CVE-2025-69970FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js.npm · fuxa-server
- CVE-2025-69981FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the `/api/upload` API endpoint.npm · fuxa-server
- CVE-2025-69983FUXA v1.2.7 allows Remote Code Execution (RCE) via the project import functionality.npm · fuxa-server
- CVE-2025-70560Boltz 2.0.0 contains an insecure deserialization vulnerability in its molecule loading functionality.PyPI · boltz
- CVE-2025-69207Khoj has an IDOR in Notion OAuth Flow Enables Index PoisoningPyPI · khoj
- CVE-2026-23997FacturaScripts has a Stored Cross-Site Scripting (XSS) in "Observations" field via History ViewPackagist · facturascripts/facturascripts
- CVE-2024-5986Remote Arbitrary File Write with Arbitrary Data in h2oai/h2o-3PyPI · h2o