Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-46370Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpointGo · github.com/fleetdm/fleet/v4 · fixed in 4.84.2
- CVE-2026-41262Fleet: Cross-Team Policy Data Exposure via Global Policy Read EndpointGo · github.com/fleetdm/fleet/v4 · fixed in 4.85.0
- CVE-2026-48786Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpointGo · github.com/fleetdm/fleet/v4 · fixed in 4.87.0
- CVE-2026-63179Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assetsPackagist · winter/wn-backend-module · fixed in 1.2.13
- CVE-2026-54256Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadataPackagist · winter/wn-backend-module · fixed in 1.2.13
- CVE-2026-32639Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploadsPackagist · winter/wn-cms-module · fixed in 1.2.13
- CVE-2026-32593Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjaxPackagist · winter/wn-backend-module · fixed in 1.2.13
- CVE-2026-32258Winter: Stored XSS through Editor Settings custom stylesPackagist · winter/wn-backend-module · fixed in 1.2.13
- CVE-2026-32257Winter: Stored XSS through Brand Settings custom stylesPackagist · winter/wn-backend-module · fixed in 1.2.13
- CVE-2026-35445Winter: Authenticated backend users can bypass Users controller permission checksPackagist · winter/wn-backend-module · fixed in 1.2.13
- CVE-2026-54614DebugKit: MailPreview contains unsafe reflectionPackagist · cakephp/debug_kit · fixed in 4.10.3, 5.2.4
- CVE-2026-54569SENAITE.CORE: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') and Missing Authorization in senaite.corePyPI · senaite-core
- CVE-2026-54606SunEditor: DOM XSS in SunEditor Embed Plugin via External Script Element After Iframe Embednpm · suneditor · fixed in 3.1.4
- CVE-2026-54511@logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keysnpm · @logtape/syslog · fixed in 2.1.5, 2.0.14, 1.3.11
- CVE-2026-54550IzPack: Path Traversal in UnpackerBase allows writing files outside the installation directory via malicious pack entriesMaven · org.codehaus.izpack:izpack-installer · fixed in 5.2.7
- CVE-2026-54523Kyverno: NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any…Go · github.com/kyverno/kyverno · fixed in 1.18.2
- CVE-2026-54548kas: Persistent SSH Host Key Checking DisablementPyPI · kas · fixed in 5.4
- CVE-2026-54553Starlette-Admin: Unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoSPyPI · starlette-admin · fixed in 0.16.1
- CVE-2026-54556Http4s: HTTP/2 Denial of Service with Ember BackendMaven · org.http4s:http4s-ember-core_2.12, org.http4s:http4s-ember-core_2.13 +1 · fixed in 0.23.35, 1.0.0-M47
- CVE-2026-80206NLTK 3.10.2 Regular Expression Denial of Service via tgrepPyPI · nltk · fixed in 3.10.3
- CVE-2026-80205NLTK before 3.10.0 ReDoS via Text.findall() unvalidated regexPyPI · nltk · fixed in 3.10.0
- CVE-2026-57171Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)PyPI · compliance-trestle · fixed in 3.12.4, 4.1.0
- CVE-2026-80202Kimai before 2.56.0 Authorization Bypass via TimesheetVoterPackagist · kimai/kimai · fixed in 2.56.0
- CVE-2026-80201Kimai before 2.53.0 API Token Leakage via Invoice TemplatePackagist · kimai/kimai · fixed in 2.53.0
- CVE-2026-80200Kimai before 2.53.0 Open Redirect via RelayStatePackagist · kimai/kimai · fixed in 2.53.0
- CVE-2026-80199Kimai before 2.54.0 Username Enumeration via Timing OraclePackagist · kimai/kimai · fixed in 2.54.0
- CVE-2026-80198Kimai before 2.56.0 Information Disclosure via config() Twig FunctionPackagist · kimai/kimai · fixed in 2.56.0
- CVE-2026-80197Kimai before 2.57.0 Improper Authorization via Favorite EndpointsPackagist · kimai/kimai · fixed in 2.57.0
- CVE-2026-80196Kimai before 2.58.0 Authentication Bypass via Password Reset LinkPackagist · kimai/kimai · fixed in 2.58.0
- CVE-2026-57170Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)PyPI · compliance-trestle · fixed in 3.12.4, 4.1.0