Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-43977wger IDOR: Authenticated Users Can Read Others' Private Workout Session Data via Template Routine APIPyPI · wger
- CVE-2026-43978wger: Privilege escalation via trainer-login session chaining allows gym trainers to impersonate gym managersPyPI · wger
- CVE-2026-55173AVideo incomplete fix for CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sinkPackagist · wwbn/avideo
- CVE-2026-46377Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted stringGo · github.com/tomwright/dasel, github.com/tomwright/dasel/v2 +1
- CVE-2026-45568zrok Python ProxyShare can be used as an SSRF proxy through absolute URL pathsPyPI · zrok
- CVE-2026-50183WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery SectionPackagist · wwbn/avideo
- CVE-2026-50182AVideo Has Unauthenticated Reflected XSS via $_GET['search'] in YouTubeAPI Gallery PaginationPackagist · wwbn/avideo
- CVE-2026-49279WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)Packagist · wwbn/avideo
- CVE-2026-493539Router: Local-Only Access Gate Bypass in 9router via Host Header SpoofINGnpm · 9router
- CVE-2025-32781Apollo: Apollo Portal release endpoint allows cross-application configuration disclosure via releaseIdMaven · com.ctrip.framework.apollo:apollo
- CVE-2026-59954Apollo ConfigService access key authentication bypass via appId parsing and non-canonical matchingMaven · com.ctrip.framework.apollo:apollo
- CVE-2026-59955Apollo ConfigService access key authentication bypass via raw config file appId parsingMaven · com.ctrip.framework.apollo:apollo
- CVE-2025-65720An issue in Open Source GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a victim system via user interaction with a PyPI · gpt-researcher
- GHSA-HGJX-R89M-M7V4FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCEPackagist · facturascripts/facturascripts
- CVE-2026-55651Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data ExposurePackagist · alextselegidis/easyappointments
- CVE-2026-52841Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google syncPackagist · alextselegidis/easyappointments
- CVE-2026-52840Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal networkPackagist · alextselegidis/easyappointments
- CVE-2026-52838Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSSPackagist · alextselegidis/easyappointments
- CVE-2026-52837Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule pagePackagist · alextselegidis/easyappointments
- CVE-2026-623289Router 0.4.41 - Unauthenticated Information Disclosure via API Usage Endpointsnpm · 9router
- CVE-2026-623279Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/statsnpm · 9router
- CVE-2026-598019Router 0.4.41 - Unauthenticated API Exposure via /api/providersnpm · 9router
- CVE-2026-11913Mother May I - Critical - Unsupported - SA-CONTRIB-2026-045Packagist · drupal/mothermayi
- CVE-2026-11914Composer - Critical - Unsupported - SA-CONTRIB-2026-046Packagist · drupal/composer
- CVE-2026-11915Brute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-047Packagist · drupal/bfap_sb
- CVE-2026-15087Clean RESTful - Critical - Unsupported - SA-CONTRIB-2026-078Packagist · drupal/clean_node_api
- CVE-2026-15086Raw Formatter [Meta Tag Formatter] - Critical - Unsupported - SA-CONTRIB-2026-077Packagist · drupal/raw_formatter
- CVE-2026-15089Commerce guest registration - Critical - Unsupported - SA-CONTRIB-2026-079Packagist · drupal/commerce_guest_registration
- CVE-2026-555009router: Exposure of Sensitive Information and Unprotected Database Import/Export Allows Complete Credential Theft and Database Takeovernpm · 9router
- CVE-2026-39243decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption.npm · decompress