Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-46552NocoDB: Shared-base link access can invite arbitrary users as persistent base membersnpm · nocodb
- CVE-2026-46553NocoDB: Attachment Size Limit Bypass via Upload-by-URLnpm · nocodb
- CVE-2026-46551NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustionnpm · nocodb
- CVE-2026-46554NocoDB: Stale Auth Cache After API Token Deletionnpm · nocodb
- CVE-2026-53927NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URLnpm · nocodb
- CVE-2026-53928NocoDB: Refresh Tokens Persist Through Password Recoverynpm · nocodb
- CVE-2026-9073Foreman-mcp-server: mcp server: insecure sensitive http header sanitizationPyPI · foreman-mcp-server
- CVE-2026-53929NocoDB: Stored Cross-Site Scripting via Secure Attachmentnpm · nocodb
- CVE-2026-53930NocoDB: Server-Side Request Forgery via Base Migration URLnpm · nocodb
- CVE-2026-53931NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpointnpm · nocodb
- CVE-2026-56696OpenHarness - Prompt Injection via /issue and /pr_comments Slash CommandsPyPI · openharness-ai
- CVE-2026-56695OpenHarness - Cross-Session Disclosure via /resume and /summary CommandsPyPI · openharness-ai
- CVE-2026-12866All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API.npm · expr-eval
- CVE-2026-39904Gophish 0.12.1 Denial of Service via Office Document UploadGo · github.com/gophish/gophish
- CVE-2026-12799BerriAI litellm Incomplete Fix CVE-2025-0628 internal_user_endpoints.py ui_view_users improper authorizationPyPI · litellm
- CVE-2026-12798BerriAI litellm MCP OpenAPI Spec Loader openapi_to_mcp_generator.py load_openapi_spec_async server-side request forgeryPyPI · litellm
- CVE-2026-12797BerriAI litellm Completions banned_keywords.py async_pre_call_hook authorizationPyPI · litellm
- CVE-2026-12796BerriAI litellm SSO Authentication Flow ui_sso.py get_redirect_response_from_openid session expirationPyPI · litellm
- CVE-2026-12795BerriAI litellm SSO Debug Flow ui_sso.py json.dumps missing authenticationPyPI · litellm
- CVE-2026-12772BerriAI litellm PROXY_ADMIN database API Key Generator login_utils.py authenticate_user session expirationPyPI · litellm
- CVE-2026-12771BerriAI litellm M2M JWT user_api_key_auth.py improper authorizationPyPI · litellm
- CVE-2026-12770BerriAI litellm Admin Key key_management_endpoints.py improper authorizationPyPI · litellm
- CVE-2026-56347AVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item FieldsPackagist · wwbn/avideo
- CVE-2026-56346AVideo - Unauthenticated PGP Message Decryption via decryptMessage.json.php EndpointPackagist · wwbn/avideo
- CVE-2026-56345AVideo - Arbitrary User Session Hijacking via Meet Plugin uploadRecordedVideo EndpointPackagist · wwbn/avideo
- CVE-2026-56341AVideo - Unauthenticated Access to Payment Log DataTables Endpoints via list.json.phpPackagist · wwbn/avideo
- CVE-2026-55746Cotonti stored XSS via PFS folder titlePackagist · cotonti/cotonti
- CVE-2026-55745Cotonti CSRF in PFS folder edit allows unauthorized folder modificationPackagist · cotonti/cotonti
- CVE-2026-55744Cotonti CSRF in PFS allows forced arbitrary file uploadPackagist · cotonti/cotonti
- CVE-2026-55742Cotonti CSRF in admin.rights.php allows privilege escalationPackagist · cotonti/cotonti