Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-72859Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URLnpm · @budibase/server
- CVE-2026-73305Budibase: Privilege escalation via public role assignment API missing app-level authorizationnpm · @budibase/server
- CVE-2026-73408Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connectornpm · @budibase/server
- CVE-2026-73302Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verifiednpm · @budibase/server
- CVE-2026-72855Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and RESTnpm · @budibase/server
- CVE-2026-72849Budibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRFnpm · @budibase/server
- CVE-2026-73652vantage6: Algorithm developer can edit another developer's algorithm that is pending / under reviewPyPI · vantage6
- CVE-2026-73568py-libp2p: yamux connection DoS via oversized data framePyPI · libp2p
- CVE-2026-73618Budibase Server before 3.40.0 NoSQL Injection via JSON Parameternpm · @budibase/server
- CVE-2026-73617Budibase before 3.40.0 NoSQL Injection via MongoDB datasourcenpm · @budibase/server
- CVE-2026-73409Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFilenpm · @budibase/server
- CVE-2026-73407Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak (bypass of CVE-2026-48152))npm · @budibase/server
- CVE-2026-73406Budibase: Unauthenticated user information disclosure via public tenant user lookup endpointnpm · @budibase/server
- CVE-2026-73308Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Buildersnpm · @budibase/server
- CVE-2026-73307Budibase: SSRF via bare fetch() in uploadUrl during AI table generationnpm · @budibase/server
- CVE-2026-73306Budibase: Account Enumeration via Login Lockout Response Differentialnpm · @budibase/server
- CVE-2026-73303Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)npm · @budibase/server
- CVE-2026-73301Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappingsnpm · @budibase/server
- CVE-2026-73300Budibase: SQL Injection via `multipleStatements: true`npm · @budibase/server
- CVE-2026-69112Hugging Face Accelerate 1.14.0 Path Traversal and DoS via weight_mapPyPI · accelerate
- CVE-2026-28672Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilderMaven · org.apache.ranger:ranger
- CVE-2026-71293Statamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current_user VariablePackagist · statamic/cms
- CVE-2026-71211mlflow - Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy EndpointPyPI · mlflow
- CVE-2026-54768WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)Packagist · wp-graphql/wp-graphql
- CVE-2026-49258Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)Go · github.com/juev/nebula-mesh
- CVE-2026-54609QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwardingnpm · qti-neon
- CVE-2026-65901DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeNamenpm · dompurify
- CVE-2026-16723Remote Code Execution in fastjson 1.2.68–1.2.83Maven · com.alibaba:fastjson
- CVE-2026-46556FlaskBB: SSRF in get_image_info() via unrestricted avatar URLPyPI · flaskbb
- CVE-2026-46412Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud wormnpm · @beproduct/nestjs-auth