Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-101051Cloudreve before 4.16.1 Path Traversal via Remote DownloadGo · github.com/cloudreve/cloudreve, github.com/cloudreve/cloudreve/v3 +1
- CVE-2026-100841MONAI through 1.6.0 PersistentDataset Remote Code Execution via Pickle CachePyPI · monai
- CVE-2026-88974WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePostPackagist · wp-graphql/wp-graphql
- CVE-2026-93748http-cache-semantics through 4.2.0 Cross-User Cache Disclosure via max-stalenpm · http-cache-semantics
- CVE-2026-93687braces through 3.0.3 Stack Overflow via Deeply Nested Patternsnpm · braces
- CVE-2026-54495Cross-namespace FeatureFlagSource and InProcessConfiguration resolution exposes spec contents on multi-tenant clustersGo · github.com/open-feature/open-feature-operator
- CVE-2026-54617GravitLauncher: Unauthenticated path traversal in LaunchServer FileServerHandlerMaven · pro.gravit.launcher:launchserver-api
- CVE-2026-49292Kiwi TCMS: The /init-db/ page renders and responds to requests after first usePyPI · kiwitcms
- CVE-2026-55630Kiwi TCMS: Stored XSS via javascript: URI in extra_link field (TestPlan & TestCase)PyPI · kiwitcms
- CVE-2026-54724Kiwi TCMS: Open Redirect via unvalidated next parameter in account confirmation endpointPyPI · kiwitcms
- CVE-2026-47780free5GC: UDR Improper ueId validation in free5GC EE subscription handlers allows arbitrary identifier persistenceGo · github.com/free5gc/udr
- CVE-2026-48987pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManagerPyPI · pyload-ng
- CVE-2026-48737pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPsPyPI · pyload-ng
- CVE-2026-55650Outerbase Studio: Stored XSS in Text Widget Leads to Authentication Token Exposurenpm · @outerbase/studio
- CVE-2026-54334UEFI Firmware Parser: Heap out-of-bounds write in tiano decompressor `ReadCLen`PyPI · uefi-firmware
- CVE-2026-54333UEFI Firmware Parser: Stack out-of-bounds write in tiano decompressor MakeTablePyPI · uefi-firmware
- CVE-2026-54628Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server ModeGo · github.com/julien040/anyquery
- CVE-2026-50006Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server ModeGo · github.com/julien040/anyquery
- CVE-2026-54629Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server ModeGo · github.com/julien040/anyquery
- CVE-2026-70658pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifierRubyGems · pay
- CVE-2026-54155node-opcua: Missing nonce verification in UserNameIdentityToken authenticationnpm · node-opcua
- CVE-2026-88062OmniRoute ACP Custom-Agent Remote Code Execution (RCE)npm · omniroute
- CVE-2026-86255wger before 2.5 Uncontrolled Resource Consumption via date_sequencePyPI · wger
- CVE-2026-53760Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET RequestsPackagist · admidio/admidio
- CVE-2026-76757Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100Packagist · drupal/gammu_smsd
- CVE-2026-76756Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100Packagist · drupal/gammu_smsd
- CVE-2026-76755Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100Packagist · drupal/gammu_smsd
- CVE-2026-76758Link content parser - Critical - Unsupported - SA-CONTRIB-2026-101Packagist · drupal/postlight_parser
- CVE-2026-76782Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102Packagist · drupal/screenshot
- CVE-2026-76759Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102Packagist · drupal/screenshot