Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-52776Trestle URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0PyPI · compliance-trestle · fixed in 4.1.0
- CVE-2026-54757Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted DataPyPI · compliance-trestle · fixed in 3.12.4, 4.1.0
- CVE-2026-44476Doorkeeper OpenID Connect: Dynamic Client Registration feature creates public clients with client_secretRubyGems · doorkeeper-openid_connect · fixed in 1.10.0
- CVE-2026-15916Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010Packagist · drupal/core · fixed in 10.6.13, 11.3.14, 11.4.4 and more
- CVE-2026-15917Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011Packagist · drupal/core · fixed in 11.3.14, 11.4.4, 11.3.0
- CVE-2026-55805Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012Packagist · drupal/core · fixed in 10.6.13, 11.3.14, 11.4.4 and more
- CVE-2026-16638Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080Packagist · drupal/media_folders · fixed in 1.0.8
- CVE-2026-16639Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081Packagist · drupal/i18n_sso · fixed in 1.8.0
- CVE-2026-16640Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082Packagist · drupal/search_api_autocomplete · fixed in 1.12.0
- CVE-2026-16641Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084Packagist · drupal/commerce_elavon
- CVE-2026-16642Email Login OTP - Critical - Unsupported - SA-CONTRIB-2026-085Packagist · drupal/email_login_otp
- CVE-2026-16643Lunr exposed filters - Critical - Unsupported - SA-CONTRIB-2026-086Packagist · drupal/lunr_filters
- CVE-2026-16644Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087Packagist · drupal/webform_rest · fixed in 4.1.0
- CVE-2026-16645PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access bypass - SA-CONTRIB-2026-088Packagist · drupal/photoswipe · fixed in 3.2.0
- CVE-2026-15088Development Environment - Critical - Unsupported - SA-CONTRIB-2026-089Packagist · drupal/development_environment
- CVE-2026-18259Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090Packagist · drupal/tca · fixed in 3.1.2
- CVE-2026-18260Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-110Packagist · drupal/disable_login · fixed in 1.1.4
- CVE-2026-18985Edit in-place field - Moderately critical - Access bypass - SA-CONTRIB-2026-093Packagist · drupal/edit_in_place_field · fixed in 2.1.1
- CVE-2026-68525Apache Tomcat: Redirect after FORM auth may bypass method specific constraintsMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 11.0.25, 10.1.58, 9.0.121
- CVE-2026-65905Apache Tomcat: Limited replay attack possible with DIGEST authenticationMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 11.0.25, 10.1.58, 9.0.121
- CVE-2026-65637Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incompleteMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-coyote · fixed in 11.0.25, 10.1.59, 9.0.121
- CVE-2026-65182Apache Tomcat: Bypass longest prefix security constraintMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 11.0.25, 10.1.58, 9.0.121
- CVE-2026-32637Velero vulnerable to file path traversal when extracting from backup's tarballGo · github.com/vmware-tanzu/velero · fixed in 1.18.1
- CVE-2026-53965MCP PHP SDK: Unbounded SSE buffer in HttpTransport enables client-side denial of servicePackagist · mcp/sdk · fixed in 0.7.1
- CVE-2026-55588ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource ConsumptionGo · oras.land/oras · fixed in 1.3.3
- CVE-2026-65087NVIDIA NemoClaw contains a vulnerability where an attacker could cause insufficiently protected credentials .PyPI · uff
- CVE-2026-55099icalendar: Algorithmic Complexity in EqualityPyPI · icalendar · fixed in 7.1.3
- CVE-2026-45019Chainlit: SSRF via MCP SSE and streamable-http transports allows unauthenticated internal network accessPyPI · chainlit · fixed in 2.12.0
- CVE-2026-45018Chainlit: Command injection via MCP stdio transport allows unauthenticated remote code executionPyPI · chainlit · fixed in 2.12.0
- CVE-2026-55609sublinear-time-solver: Arbitrary file write in consciousness-explorer / sublinear-time-solver MCP export_statenpm · consciousness-explorer, sublinear-time-solver · fixed in 1.1.2, 1.6.0