Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-79675NLTK before 3.10.3 JVM Argument Injection via Per-Call OptionsPyPI · nltk · fixed in 3.10.3
- CVE-2026-79674NLTK 3.10.2 Path Traversal via corpus-reader constructorsPyPI · nltk · fixed in 3.10.3
- CVE-2026-55533PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secretPyPI · praisonai · fixed in 4.6.58
- CVE-2026-55539PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and deletePyPI · praisonai · fixed in 4.6.58
- CVE-2026-55527PraisonAI: Arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable locationPyPI · praisonaiagents · fixed in 1.6.58
- CVE-2026-55541PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforcedPyPI · praisonai · fixed in 4.6.58
- CVE-2026-55535PraisonAI: Server-Side Request Forgery via DNS rebinding bypass in webhook_url validationPyPI · praisonai · fixed in 4.6.58
- CVE-2026-55537PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114PyPI · praisonai · fixed in 4.6.58
- CVE-2026-55538PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticatedPyPI · praisonai · fixed in 4.6.58
- CVE-2026-55540PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinksPyPI · praisonai · fixed in 4.6.58
- CVE-2026-55530PraisonAI: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation toolPyPI · praisonaiagents · fixed in 1.6.58
- CVE-2026-55534PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent executionPyPI · praisonai · fixed in 4.6.58
- CVE-2026-55526PraisonAI: SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)PyPI · praisonaiagents · fixed in 1.6.58
- CVE-2026-55531PraisonAI: Unauthenticated unbounded session accumulation in the PraisonAI MCP HTTP server (memory exhaustion; session TTL never enforced)PyPI · praisonai · fixed in 4.6.58
- CVE-2026-55528praisonaiagents: AgentServer declares auth_token but never enforces it on any route (CWE-862)PyPI · praisonaiagents · fixed in 1.6.58
- CVE-2026-55529PraisonAI: Origin validation bypass in MCP HTTP Stream transport allows browser-mediated unauthenticated tool execution on local MCP serverPyPI · praisonai · fixed in 4.6.58
- CVE-2026-55525PraisonAI: SSRF via redirect-following in praisonaiagents web_crawlPyPI · praisonaiagents · fixed in 1.6.58
- CVE-2026-79673Ech0 before 4.4.3 Scope Bypass via profile:read TokenGo · github.com/lin-snow/ech0 · fixed in 4.4.3
- CVE-2026-79672Ech0 before 4.4.3 Authentication Bypass via Comment PanelGo · github.com/lin-snow/ech0 · fixed in 4.4.3
- CVE-2026-79671Ech0 before 4.4.3 SSRF via DNS Resolution BypassGo · github.com/lin-snow/ech0 · fixed in 4.4.3
- CVE-2026-79670Ech0 before 4.4.3 Stored XSS via SVG UploadGo · github.com/lin-snow/ech0 · fixed in 4.4.3
- CVE-2026-79669Ech0 before 4.4.3 Missing Authorization on System LogsGo · github.com/lin-snow/ech0 · fixed in 4.4.3
- CVE-2026-79668Ech0 before 4.7.3 Unauthenticated Like Endpoint Metric InflationGo · github.com/lin-snow/ech0 · fixed in 1.4.8-0.20260503040728-a7e8b8e84bd1
- CVE-2026-79667Ech0 before 4.4.3 Authentication Bypass via Scope EnforcementGo · github.com/lin-snow/ech0 · fixed in 4.3.5
- CVE-2026-79666Ech0 before 4.4.3 Missing Authorization via dashboard log endpointsGo · github.com/lin-snow/ech0 · fixed in 4.3.5
- CVE-2026-79664Ech0 before 4.7.3 Access Token Revocation BypassGo · github.com/lin-snow/ech0 · fixed in 1.4.8-0.20260503041146-eab62379c795
- CVE-2026-79663Ech0 before 4.7.3 Stored XSS via RSS feed tag namesGo · github.com/lin-snow/ech0 · fixed in 1.4.8-0.20260503035519-fd320fe3e902
- CVE-2026-79662Ech0 before 4.7.3 OAuth Redirect URI Validation BypassGo · github.com/lin-snow/ech0 · fixed in 1.4.8-0.20260503040728-a7e8b8e84bd1
- CVE-2026-79661Ech0 before 4.7.3 Unauthenticated fav_count ModificationGo · github.com/lin-snow/ech0 · fixed in 1.4.8-0.20260503035905-cecc2c19b590
- CVE-2026-79660Ech0 before 4.7.3 Email Disclosure via Public APIGo · github.com/lin-snow/ech0 · fixed in 1.4.8-0.20260503034700-cb8d7a997dd8