Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-80047Hugging Face Transformers library writes remote code to disk prior to consent checkPyPI · transformers
- CVE-2026-84196Kyverno before 1.18.0 Server-Side Request Forgery via apiCallGo · github.com/kyverno/kyverno
- CVE-2025-15613Kyverno before v1.13.4 SSRF via Service CallGo · github.com/kyverno/kyverno
- CVE-2026-55784free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPIGo · github.com/free5gc/ausf
- CVE-2026-54569SENAITE.CORE: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') and Missing Authorization in senaite.corePyPI · senaite-core
- CVE-2026-16641Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084Packagist · drupal/commerce_elavon
- CVE-2026-16642Email Login OTP - Critical - Unsupported - SA-CONTRIB-2026-085Packagist · drupal/email_login_otp
- CVE-2026-16643Lunr exposed filters - Critical - Unsupported - SA-CONTRIB-2026-086Packagist · drupal/lunr_filters
- CVE-2026-15088Development Environment - Critical - Unsupported - SA-CONTRIB-2026-089Packagist · drupal/development_environment
- CVE-2026-65087NVIDIA NemoClaw contains a vulnerability where an attacker could cause insufficiently protected credentials .PyPI · uff
- CVE-2026-49845Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL pathsMaven · org.apache.hive:hive-standalone-metastore
- CVE-2026-76845adm-zip 0.5.9 through 0.6.0 Arbitrary File Overwrite via Symlink Following on Extractionnpm · adm-zip
- CVE-2026-78209exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Valuesnpm · exceljs
- CVE-2026-78208exceljs through 4.4.0 Path Traversal via Unvalidated addImage filenamenpm · exceljs
- CVE-2026-78207exceljs through 4.4.0 Prototype Pollution via deepMerge Reached From Note Serializationnpm · exceljs
- CVE-2026-78206exceljs through 4.4.0 Uncontrolled Resource Consumption via Unbounded xlsx Decompressionnpm · exceljs
- CVE-2026-43980Malla: Stored XSS via Meshtastic node names in multiple frontend pagesPyPI · malla
- CVE-2026-77763JuiceFS Local Filestore Backend Joins Object Keys onto the Storage Root Without a Containment Check, Allowing Writes Outside the…Go · github.com/juicedata/juicefs
- CVE-2026-728609router Server-Side Request Forgery via /api/provider-nodes/validate Because the IPv4-Mapped IPv6 Denylist Check Is Unreachablenpm · 9router
- CVE-2026-63481Hurl: Cookies in Cookies section leak when redirecting to a different hostcrates.io · hurl
- CVE-2026-54449LangBot: Authenticated RCE Via MCP ConfigurationPyPI · langbot
- CVE-2026-45741Gotenberg: SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixesGo · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8
- CVE-2026-47721FUXA: Scheduler API missing admin check enables operator-to-admin escalation via scheduled device actionsnpm · fuxa-server
- CVE-2026-47719FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response readingnpm · fuxa-server
- CVE-2026-47720FUXA: SQL injection in TDengine DAQ connector via backslash bypass of escapeTdStringnpm · fuxa-server
- CVE-2026-49452WeasyPrint: CSS Injection via Presentational HintsPyPI · weasyprint
- CVE-2026-566779Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpointnpm · 9router
- CVE-2026-54356Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`npm · @budibase/server
- CVE-2026-73410Budibase: SSRF via DNS rebinding in the REST datasource integrationnpm · @budibase/server
- CVE-2026-19693extract-zip arbitrary file write outside the destination directory via a symlink at the final path componentnpm · extract-zip