Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-15035bentoml OpenLLM Model Repository Directory Name common.py async_run_command command injectionPyPI · bentoml
- CVE-2026-60092AVideo - Stored Cross-Site Scripting via Unescaped User-Agent in Participants PanelPackagist · wwbn/avideo
- GO-2026-5932The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issuesGo · golang.org/x/crypto
- CVE-2026-59710showdown - Stored XSS via Unescaped Table Header ID Attribute Injectionnpm · showdown
- CVE-2026-59711showdown - Cross-Site Scripting via Unescaped Metadata Title in completeHTMLDocumentnpm · showdown
- CVE-2026-14802react create-react-app react-dev-utils openBrowser.js startBrowserProcess os command injectionnpm · react-dev-utils
- CVE-2026-14722tiddly-gittly TidGi-Desktop Git Repository Import loadWikiTiddlersWithSubWikis.ts code injectionnpm · tidgi
- CVE-2025-71380n8n - Arbitrary Command Execution via Execute Command Nodenpm · n8n, n8n-nodes-base
- CVE-2026-56876extract-zip unvalidated symlink path traversalnpm · extract-zip
- CVE-2026-11779PayloadCMS 3.84.1 - Authenticated account lockout bypass through default unlock accessnpm · payload
- CVE-2026-6658Cross-site Scripting (XSS) in jupyter/nbconvertPyPI · nbconvert
- CVE-2026-13322Kubevirt: virt-handler-rhel9: kubevirt: unbounded virtio-serial readline in virt-handler causes oom denial of serviceGo · github.com/kubevirt/kubevirt, kubevirt.io/kubevirt
- CVE-2026-13218Kubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcherGo · kubevirt.io/kubevirt
- CVE-2025-71338Flowise through 2.2.7 - Arbitrary File Write to Remote Code Execution via document-store APInpm · flowise
- CVE-2025-71333Flowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpointnpm · flowise
- CVE-2025-71327Flowise - Authentication Bypass via Unprotected Registration Endpointnpm · flowise
- CVE-2026-54089File Browser: Authentication Bypass via Proxy Auth Header ForgeryGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2
- CVE-2026-11998AngularJS XSS via SCE resource URL sanitization bypassnpm · angular
- CVE-2026-57307A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers with Overall/Read permissionMaven · io.jenkins.plugins:zdevops
- CVE-2026-57306A cross-site request forgery (CSRF) vulnerability in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers to coMaven · io.jenkins.plugins:zdevops
- CVE-2026-57305A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Plugin 1.4 and earlier allows attackers to connect to an attacker-specMaven · org.jenkins-ci.plugins:assembla
- CVE-2026-57304A missing permission check in Jenkins Assembla Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attackeMaven · org.jenkins-ci.plugins:assembla
- CVE-2026-57303Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers aMaven · org.jenkins-ci.plugins:assembla
- CVE-2026-57302Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be vMaven · org.jenkins-ci.plugins:fitnesse
- CVE-2026-57301Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attaMaven · org.jenkins-ci.plugins:zapper
- CVE-2025-71332Flowise - SQL Injection in importChatflows API via chatflow.id Parameternpm · flowise
- CVE-2026-46547NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URLnpm · nocodb
- CVE-2026-46548NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams)npm · nocodb
- CVE-2026-46549NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalationnpm · nocodb
- CVE-2026-46550NocoDB: Refresh Token Cookie Set Without `Secure` and `SameSite` Flagsnpm · nocodb