Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-77063multer vulnerable to file size limit bypass via async fileFilter race conditionnpm · multer · fixed in 2.3.0
- CVE-2026-77037multer vulnerable to Denial of Service via file descriptor leak on aborted uploadsnpm · multer · fixed in 2.3.0
- CVE-2026-55484ALOS HTTP: Unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire serverGo · github.com/guno1928/alos-http · fixed in 0.0.0-20260617230736-314b6783e196
- CVE-2026-55634Pimcore: Remote Code Execution via DataObject Class-Definition Field NamePackagist · pimcore/pimcore · fixed in 12.3.10, 2026.1.6
- CVE-2026-55220Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store columnPackagist · pimcore/pimcore · fixed in 2026.1.6, 12.3.10
- CVE-2026-55215MariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: true`npm · mariadb · fixed in 3.2.4, 3.3.3, 3.4.6 and more
- CVE-2026-55247plone.app.event: Denial of service via iCalendar importPyPI · plone-app-event · fixed in 5.2.4, 6.0.1
- CVE-2026-55520Protego: Exponential backtracking ReDoS in robots.txt URL wildcard matchingPyPI · protego · fixed in 0.6.2
- CVE-2026-55248plone.app.portlets: Denial of service via RSS feed portletPyPI · plone-app-portlets · fixed in 5.0.8, 6.0.4, 7.0.2
- CVE-2026-55673PowSyBl: Command Injection in LocalCommandExecutor-sMaven · com.powsybl:powsybl-computation-local · fixed in 7.2.2
- CVE-2026-55584phpSysInfo: IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headersPackagist · phpsysinfo/phpsysinfo · fixed in 3.4.6
- CVE-2026-55245Bifrost: SSRF deny-list incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURLGo · github.com/maximhq/bifrost/core · fixed in 1.5.17
- CVE-2026-55485Piccolo Admin: Privilege escalation - admin to superuser via session-token disclosure in GET /api/tables/sessions/.PyPI · piccolo-admin · fixed in 1.14.0
- CVE-2026-55509WsgiDAV: Blind SQL injection in the MySQL providerPyPI · wsgidav · fixed in 4.3.5
- CVE-2026-55425Graylog: System Catalog titles endpoint can be used to retrieve values of protected database fieldsMaven · org.graylog2:graylog2-server · fixed in 7.1.4
- CVE-2026-55566Yamcs: DOM XSS in Extension RoutingMaven · org.yamcs:yamcs-core · fixed in 5.13.2, 5.12.8
- CVE-2026-55565Yamcs: Authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)Maven · org.yamcs:yamcs-core · fixed in 5.13.2, 5.12.8
- CVE-2026-55559Yamcs: Remote Code Execution via instance-template argument YAML injection (createInstance)Maven · org.yamcs:yamcs-core · fixed in 5.13.2, 5.12.8
- CVE-2026-55552Yamcs: Unauthenticated Directory TraversalMaven · org.yamcs:yamcs-core · fixed in 5.12.0
- CVE-2026-55549Yamcs: Reflected XSS in the URL of the Authorize EndpointMaven · org.yamcs:yamcs-core · fixed in 5.9.4
- CVE-2026-55547Yamcs: Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security ConfigurationMaven · org.yamcs:yamcs-core · fixed in 5.13.2, 5.12.8
- CVE-2026-55545Yamcs: WebSocket subscription handlers omit the privilege checks their REST siblings enforceMaven · org.yamcs:yamcs-core · fixed in 5.12.8, 5.13.2
- CVE-2026-55521Yamcs : Multiple Missing Function Level Access Control vulnerabilities in Yamcs Core APIMaven · org.yamcs:yamcs-core · fixed in 5.13.2, 5.12.8
- CVE-2026-55511Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`Maven · org.yamcs:yamcs-core · fixed in 5.13.2, 5.12.8
- CVE-2026-55068free5GC: NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpointsGo · github.com/free5gc/free5gc · fixed in 4.2.2, 4.2.2+incompatible
- CVE-2026-55067Vikunja: Authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignmentGo · code.vikunja.io/api · fixed in 2.4.0
- CVE-2026-55066Vikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_idGo · code.vikunja.io/api · fixed in 2.4.0
- CVE-2026-55065Vikunja: Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/apiGo · code.vikunja.io/api · fixed in 2.4.0
- CVE-2026-55064Vikunja incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0Go · code.vikunja.io/api · fixed in 2.4.0
- CVE-2026-54766Vikunja: Project duplication bypasses write-permission check on the target parent projectGo · code.vikunja.io/api · fixed in 2.4.0