Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-70958Multiple reflected cross-site scripting (XSS) vulnerabilities in the installation module of Subrion CMS v4.2.1 allows attackers to execute aPackagist · intelliants/subrion
- CVE-2025-70959A stored cross-site scripting (XSS) vulnerability in the Jobs module of Tendenci CMS v15.3.7 allows attackers to execute arbitrary web scripPyPI · tendenci
- CVE-2025-70960A stored cross-site scripting (XSS) vulnerability in the Forums module of Tendenci CMS v15.3.7 allows attackers to execute arbitrary web scrPyPI · tendenci
- CVE-2020-37044OpenCTI 3.3.1 - Cross Site ScriptingPyPI · pycti
- CVE-2020-37041OpenCTI 3.3.1 - Directory TraversalPyPI · pycti
- CVE-2026-25130Cybersecurity AI vulnerable to command Injection through argument injection in find_file Agent toolPyPI · cai-framework
- CVE-2026-24780AutoGPT is Vulnerable to RCE via Disabled Block ExecutionPyPI · agpt
- CVE-2026-1237Vulnerable cross-model authorization in juju.Go · github.com/juju/juju
- CVE-2020-36947LibreNMS 1.46 - MAC Accounting Graph Authenticated SQL InjectionPackagist · librenms/librenms
- CVE-2020-36939Cassandra Web 0.5.0 - Remote File ReadRubyGems · cassandra-web
- CVE-2026-24819An out-of-memory (OOM) issue in foxinmy/weixin4jMaven · com.foxinmy:weixin4j-base
- CVE-2026-24807Buffer Overflow Vulnerability in liuyueyi/quick-mediaMaven · com.github.liuyueyi.media:batik-codec-fix
- CVE-2026-24806Buffer Write Security Vulnerability in liuyueyi/quick-mediaMaven · com.github.liuyueyi.media:batik-codec-fix
- CVE-2026-1190Org.keycloak/keycloak-services: keycloak saml brokering: response delay due to unchecked notonorafter in subjectconfirmationdataMaven · org.keycloak:keycloak-services
- CVE-2025-14525Kubevirt: kubevirt: vm administration denial of service via guest agentGo · kubevirt.io/kubevirt
- CVE-2016-15057Apache Continuum: Command injection leading to RCEMaven · org.apache.continuum:continuum
- CVE-2025-71177LavaLite CMS <= 10.1.0 Stored XSS via Package Creation and SearchPackagist · lavalite/cms
- CVE-2026-0770Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution VulnerabilityPyPI · langflow
- CVE-2026-23954Incus container image templating arbitrary host file read and writeGo · github.com/lxc/incus, github.com/lxc/incus/v6 +1
- CVE-2025-14083Keycloak-server: keycloak: improper access control in admin rest api leads to information disclosureMaven · org.keycloak:keycloak-services
- CVE-2026-1035Org.keycloak.protocol.oidc: keycloak refresh token reuse bypass via toctou race conditionMaven · org.keycloak:keycloak-services
- CVE-2026-1180Org.keycloak.protocol.oidc: blind server-side request forgery (ssrf) in keycloak oidc dynamic client registration via jwks_uriMaven · org.keycloak:keycloak-adapter-core
- CVE-2026-1196MineAdmin getFileInfoById information disclosurePackagist · mineadmin/mineadmin
- CVE-2026-1195MineAdmin JWT Token refresh data authenticityPackagist · mineadmin/mineadmin
- CVE-2026-1194MineAdmin Swagger information disclosurePackagist · mineadmin/mineadmin
- CVE-2026-1193MineAdmin View view improper authorizationPackagist · mineadmin/mineadmin
- CVE-2026-23522Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletionnpm · @lobehub/chat
- CVE-2026-23733Lobe Chat has Cross-Site Scripting (XSS) issue that may escalate to Remote Code Execution (RCE)npm · @lobehub/chat
- CVE-2026-1050risesoft-y9 Digital-Infrastructure REST Authenticate Endpoint Y9PlatformUtil.java sql injectionMaven · net.risesoft:risenet-y9boot-support-platform-service
- CVE-2025-15104Nu Html Checker (validator.nu) - Restriction bypass vulnerability allowing local SSRFnpm · vnu-jar