Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-82854Nodemailer before 8.0.4 SMTP Command Injection via envelope.sizenpm · nodemailer · fixed in 8.0.4
- CVE-2026-82853Nodemailer before 8.0.5 SMTP Command Injection via CRLFnpm · nodemailer · fixed in 8.0.5
- CVE-2026-82662Nodemailer before 8.0.8 TLS Certificate Validation Bypassnpm · nodemailer · fixed in 8.0.8
- CVE-2026-82661Nodemailer CRLF Injection via List-* Header Commentsnpm · nodemailer · fixed in 8.0.9
- CVE-2026-82660Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccessnpm · nodemailer · fixed in 8.0.9
- CVE-2026-82659nodemailer before 9.0.1 File Read and SSRF via raw optionnpm · nodemailer · fixed in 9.0.1
- CVE-2024-58379nodemailer before 6.9.9 ReDoS via attachDataUrls parameternpm · nodemailer · fixed in 6.9.9
- CVE-2026-82651SiYuan before v3.8.1 Missing Authorization via /history and /repo/diffGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260816034002-035bf9a8c311
- CVE-2026-82562qs.parse does not enforce arrayLimit on comma groups under bracket-push keys when throwOnLimitExceeded is set (incomplete fix for CVE-2026-2391)npm · qs · fixed in 6.16.0
- CVE-2026-82417qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer propertynpm · qs · fixed in 6.16.0
- CVE-2026-55860MariaDB Connector/R2DBC: Cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)Maven · org.mariadb:r2dbc-mariadb · fixed in 1.4.1
- CVE-2026-55859MariaDB Connector/R2DBC: Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output in org.mariadb:r2dbc-mariadbMaven · org.mariadb:r2dbc-mariadb · fixed in 1.4.1
- CVE-2026-55858MariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb-java-clientMaven · org.mariadb.jdbc:mariadb-java-client · fixed in 2.7.14, 3.3.5, 3.4.3 and more
- CVE-2026-55857MariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Protected CredentialsMaven · org.mariadb.jdbc:mariadb-java-client · fixed in 2.7.14, 3.3.5, 3.4.3 and more
- CVE-2026-55856MariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshakeMaven · org.mariadb.jdbc:mariadb-java-client · fixed in 2.7.14, 3.3.5, 3.4.3 and more
- CVE-2026-55848mapfish-print: XXE on MapFish Print allows reading arbitrary files of certain typesMaven · org.mapfish.print:print-lib, org.mapfish.print:print-servlet +1 · fixed in 3.28.30, 3.30.32, 3.33.16 and more
- CVE-2026-55785free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKAGo · github.com/free5gc/ausf · fixed in 1.4.5
- CVE-2026-55784free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPIGo · github.com/free5gc/ausf
- CVE-2026-55779Silverstripe Versioned: XSS in archive admin restorePackagist · silverstripe/versioned · fixed in 3.2.1
- CVE-2026-55867Graylog token revocation endpoint allows authenticated users to delete other users’ access tokensMaven · org.graylog2:graylog2-server · fixed in 6.3.12, 7.0.7, 7.1.2
- CVE-2026-55841Graylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original messageMaven · org.graylog2:graylog2-server · fixed in 6.3.12, 7.0.7, 7.1.2
- CVE-2026-55764Klever-Go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupplyGo · github.com/klever-io/klever-go · fixed in 1.7.19
- CVE-2026-55855MariaDB Connector/Node.js: Possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsetsnpm · mariadb · fixed in 3.2.4, 3.3.4, 3.4.6 and more
- CVE-2026-55854MariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials in mariadbnpm · mariadb · fixed in 3.2.4, 3.3.3, 3.4.6 and more
- CVE-2026-55678Arc: Unauthenticated cluster node admission when `cluster.shared_secret` is unsetGo · github.com/basekick-labs/arc · fixed in 0.0.0-20260615160325-38402ad2ebdd
- CVE-2026-55763Klever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splitsGo · github.com/klever-io/klever-go · fixed in 1.7.19-rc4
- CVE-2026-55891PrivateBin: Reflected JSON injection in backend responses via unescaped REQUEST_URIPackagist · privatebin/privatebin · fixed in 2.0.5
- CVE-2026-55696PrivateBin: Stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interactionPackagist · privatebin/privatebin · fixed in 2.0.5
- CVE-2026-82333multer vulnerable to Denial of Service via oversized array index in field namesnpm · multer · fixed in 2.3.0
- CVE-2026-77078multer vulnerable to Denial of Service via crafted multipart field namesnpm · multer · fixed in 2.3.0