Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-120091Temporal Server Kubernetes compute provider builds a client from caller-supplied configuration and runs a caller-chosen command on the…Go · go.temporal.io/server · fixed in 1.31.5, 1.32.2
- CVE-2026-105769kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hostsGo · github.com/chainguard-dev/kaniko · fixed in 1.25.20
- CVE-2026-120492Chainlit 2.12.0 SSRF via Semicolon Path Segment in MCP allowed_urlsPyPI · chainlit · fixed in 2.12.0
- CVE-2026-111959Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds readscrates.io · arrow, arrow-data · fixed in 60.1.0, 57.3.2, 58.4.1 and more
- CVE-2026-114364Apache Syncope: SQL injection via unsanitized opEvent in Audit Events searchMaven · org.apache.syncope.core:syncope-core-persistence-jpa
- CVE-2026-113687Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypassMaven · org.apache.syncope.core:syncope-core-spring
- CVE-2026-113511Apache Syncope: Delegated administration boundaries can be bypassed for Realm updateMaven · org.apache.syncope.core.idrepo:syncope-core-idrepo-logic
- CVE-2026-110535Apache Syncope: AuthProfile value escalation via self-service updateMaven · org.apache.syncope.core.am:syncope-core-am-logic
- CVE-2026-109083Apache Syncope: Remote Code Execution via Flowable JUEL expressionMaven · org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn
- CVE-2026-111089Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markupMaven · org.apache.wicket:wicket-core
- CVE-2026-95863Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markupMaven · org.apache.wicket:wicket-core
- CVE-2026-87718Apache Wicket: CSP headers silently omitted for pages served through nested request handler delegatesMaven · org.apache.wicket:wicket-core
- CVE-2026-84231Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tagMaven · org.apache.wicket:wicket-core
- CVE-2026-84177Apache Wicket: A component's markup is served as a package resource when its class name contains an underscoreMaven · org.apache.wicket:wicket-core
- CVE-2026-84172Apache Wicket: Component markup is served as a package resource when wicket-core has its own class loaderMaven · org.apache.wicket:wicket-core
- CVE-2026-84170Apache Wicket: Configured upload limits are not enforced by the standalone file upload resourceMaven · org.apache.wicket:wicket-core
- CVE-2026-83594Apache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it namesMaven · org.apache.wicket:wicket-core
- CVE-2026-83559Apache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literalMaven · org.apache.wicket:wicket-core
- CVE-2026-83539Apache Wicket: XSS in SmartLinkLabel and SmartLinkMultiLineLabel via a javascript: URL in the model dataMaven · org.apache.wicket:wicket-extensions
- CVE-2026-82956Apache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window nameMaven · org.apache.wicket:wicket-core
- CVE-2026-82898Apache Wicket: A cross-origin listener invocation stopped by a login wall is replayed after the user signs inMaven · org.apache.wicket:wicket-core
- CVE-2026-82840Apache Wicket: The session id is renewed only on the first sign in, not on re-authenticationMaven · org.apache.wicket:wicket-auth-roles
- CVE-2026-82705Apache Wicket: The configured authorization strategy is not applied to an IResource embedded in a componentMaven · org.apache.wicket:wicket-core
- CVE-2026-82704Apache Wicket: A listener is invoked on a page instance the request itself created and never configuredMaven · org.apache.wicket:wicket-core
- CVE-2026-82559Apache Wicket: WebSocket messages are processed against an HTTP session snapshot that survives invalidationMaven · org.apache.wicket:wicket-native-websocket-core
- CVE-2026-82558Apache Wicket: WebSocketBehavior delivers client messages to a component the client may not invokeMaven · org.apache.wicket:wicket-native-websocket-core
- CVE-2026-82557Apache Wicket: A disabled or invisible form submitting component is still invoked on a plain form submissionMaven · org.apache.wicket:wicket-core
- CVE-2026-82115Apache Wicket: The configured authorization strategy is not applied to a shared WebSocketResourceMaven · org.apache.wicket:wicket-native-websocket-core
- CVE-2026-117680jsv treats regex match budget exhaustion as a non-match, bypassing patternProperties and notHex · jsv · fixed in 0.26.2
- RUSTSEC-2026-0430Path traversal in `rio-vt` Kitty graphics protocol handler allows out-of-bounds file delete (and read)crates.io · rio-vt · fixed in 0.5.29