Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-54732libreoffice-convert: path traversal / arbitrary file writenpm · libreoffice-convert · fixed in 1.8.2
- CVE-2026-54718Silverstripe Advanced Workflow: Remote code execution via advanced workflow email templatePackagist · symbiote/silverstripe-advancedworkflow · fixed in 6.4.5, 7.1.3, 7.2.1
- CVE-2026-54687n8n-nodes-sqlite3: Path traversal via user-controlled database file path (db_path parameter)npm · n8n-nodes-sqlite3 · fixed in 1.0.0
- CVE-2026-54713CakePHP Queue: Incomplete Comparison in getUniqueId vulnerable to collisionsPackagist · cakephp/queue · fixed in 2.3.1
- CVE-2026-54721Silverstripe UserForms: Remote code execution via userforms email subjectPackagist · silverstripe/userforms · fixed in 6.4.9, 7.0.7, 7.1.1
- CVE-2026-79720Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perPyPI · netron · fixed in 9.1.3
- CVE-2026-79719Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perPyPI · netron · fixed in 9.1.3
- CVE-2026-79718Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perPyPI · netron · fixed in 9.1.3
- CVE-2026-81727NLTK before 3.10.3 Hardlink File Overwrite via downloaderPyPI · nltk · fixed in 3.10.3
- CVE-2026-81726NLTK through 3.10.3 Path Traversal via Model-Artifact APIsPyPI · nltk · fixed in 3.10.3
- CVE-2026-81725NLTK before 3.10.3 Regular Expression Denial of Service via Pl196xCorpusReaderPyPI · nltk · fixed in 3.10.3
- CVE-2026-81724NLTK before 3.10.3 Denial of Service via Uncontrolled RecursionPyPI · nltk · fixed in 3.10.3
- CVE-2026-81723NLTK before 3.10.3 Quadratic CPU Exhaustion via XMLCorpusViewPyPI · nltk · fixed in 3.10.3
- CVE-2026-81722nltk PorterStemmer before 3.10.3 Quadratic-time DoSPyPI · nltk · fixed in 3.10.3
- CVE-2026-81721openssl_encrypt before 1.4.9 Denial of Service via KDFPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81720openssl_encrypt before 1.4.9 Denial of Service via Unbounded Argon2PyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81719openssl_encrypt before 1.4.9 Remote Code Execution via PluginPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81717openssl_encrypt before 1.4.9 Integrity Bypass via Added FilesPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81716openssl_encrypt before 1.4.9 Plugin Sandbox Path TraversalPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81715openssl_encrypt before 1.4.9 Credential Exposure via Debug OutputPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81714openssl_encrypt before 1.4.9 Plugin Signing Trust Anchor Enrollment BypassPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81706openssl_encrypt before 1.4.9 Key Substitution via Identity ShadowingPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81705openssl-encrypt before 1.4.9 Password Cleartext Leak via DebugPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81704openssl_encrypt before 1.4.9 Weak Key Derivation via D-BusPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81703openssl_encrypt before 1.4.9 Authentication Bypass via Unencrypted PQC KeyPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81702openssl_encrypt before 1.4.9 Key Substitution via Identity LoadPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81701openssl_encrypt before 1.4.9 Arbitrary Code Execution via unsigned pluginPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81700openssl_encrypt before 1.4.9 GPG Signature Verification BypassPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81699openssl_encrypt before 1.4.9 Denial of Service via unbounded KDF costPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81698openssl_encrypt before 1.4.9 Shell Injection via info commandPyPI · openssl-encrypt · fixed in 1.4.9