Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-81700openssl_encrypt before 1.4.9 GPG Signature Verification BypassPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81699openssl_encrypt before 1.4.9 Denial of Service via unbounded KDF costPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81698openssl_encrypt before 1.4.9 Shell Injection via info commandPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81696openssl_encrypt before 1.4.9 Terminal Injection via info CommandPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81695openssl_encrypt before 1.4.9 Terminal Injection via key_idPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81694openssl-encrypt before 1.4.9 Output Injection via Unsanitized Filenames in verify-usb CommandPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81693openssl_encrypt before 1.4.9 Denial of Service via QR total fieldPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81691openssl_encrypt before 1.4.9 Credential Leakage via Unvalidated Server URLsPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81690verify-usb before 1.4.9 Symlink Directory Traversal Code ExecutionPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81689openssl_encrypt before 1.4.9 Weak Pepper Key DerivationPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81688openssl_encrypt before 1.4.9 Plaintext Confirmation Oracle via SHA-256PyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81686openssl_encrypt before 1.4.9 D-Bus Properties Authorization BypassPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81685openssl_encrypt before 1.4.9 Text Injection via Recovery Slot MetadataPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81684openssl_encrypt before 1.4.9 Information Disclosure via Command LinePyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81683openssl_encrypt before 1.4.9 Plaintext Private Key StoragePyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81681openssl_encrypt before 1.4.9 False Encryption via Cleartext StoragePyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81680openssl_encrypt before 1.4.9 Authentication Bypass via Recovery Slot RemovalPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-47892Spring Framework Header Predicate Bypass in WebFlux Functional EndpointsMaven · org.springframework:spring-webflux · fixed in 7.0.9
- CVE-2026-47890Spring Framework Server Sent Event stream corruption while rendering fragmentsMaven · org.springframework:spring-webflux, org.springframework:spring-webmvc · fixed in 7.0.9
- CVE-2026-47884Spring Framework Improper Path Limitation in XsltViewMaven · org.springframework:spring-webmvc · fixed in 7.0.9
- CVE-2026-37004BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arPyPI · litellm · fixed in 1.83.7
- CVE-2026-55182LibreNMS: Remote Code Execution by Signal Alert Transportation ModulePackagist · librenms/librenms · fixed in 26.5.0
- CVE-2026-45694LibreNMS: Reflected XSS in the Proxmox app view via unsanitized instance/vmid parametersPackagist · librenms/librenms · fixed in 26.5.0
- CVE-2026-79921amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized PayloadGo · github.com/rabbitmq/amqp091-go · fixed in 1.13.0
- CVE-2026-55228Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorized read access to any private projectPyPI · weblate · fixed in 2026.7
- CVE-2026-55227Observable object existence disclosure in private Weblate projects via globally scoped object lookupsPyPI · weblate · fixed in 2026.7
- CVE-2026-60004Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.Go · code.gitea.io/gitea, gitea.dev · fixed in 1.27.1
- CVE-2026-46369Nimiq: Validity store off by one errorcrates.io · nimiq-blockchain · fixed in 1.5.1
- CVE-2026-54245Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet databaseGo · github.com/fleetdm/fleet, github.com/fleetdm/fleet/v4 · fixed in 4.86.2
- CVE-2026-46371Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpointGo · github.com/fleetdm/fleet/v4 · fixed in 4.84.2