Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-79671Ech0 before 4.4.3 SSRF via DNS Resolution BypassGo · github.com/lin-snow/ech0 · fixed in 4.4.3
- CVE-2026-79670Ech0 before 4.4.3 Stored XSS via SVG UploadGo · github.com/lin-snow/ech0 · fixed in 4.4.3
- CVE-2026-79669Ech0 before 4.4.3 Missing Authorization on System LogsGo · github.com/lin-snow/ech0 · fixed in 4.4.3
- CVE-2026-79668Ech0 before 4.7.3 Unauthenticated Like Endpoint Metric InflationGo · github.com/lin-snow/ech0 · fixed in 1.4.8-0.20260503040728-a7e8b8e84bd1
- CVE-2026-79667Ech0 before 4.4.3 Authentication Bypass via Scope EnforcementGo · github.com/lin-snow/ech0 · fixed in 4.3.5
- CVE-2026-79666Ech0 before 4.4.3 Missing Authorization via dashboard log endpointsGo · github.com/lin-snow/ech0 · fixed in 4.3.5
- CVE-2026-79664Ech0 before 4.7.3 Access Token Revocation BypassGo · github.com/lin-snow/ech0 · fixed in 1.4.8-0.20260503041146-eab62379c795
- CVE-2026-79663Ech0 before 4.7.3 Stored XSS via RSS feed tag namesGo · github.com/lin-snow/ech0 · fixed in 1.4.8-0.20260503035519-fd320fe3e902
- CVE-2026-79662Ech0 before 4.7.3 OAuth Redirect URI Validation BypassGo · github.com/lin-snow/ech0 · fixed in 1.4.8-0.20260503040728-a7e8b8e84bd1
- CVE-2026-79661Ech0 before 4.7.3 Unauthenticated fav_count ModificationGo · github.com/lin-snow/ech0 · fixed in 1.4.8-0.20260503035905-cecc2c19b590
- CVE-2026-79660Ech0 before 4.7.3 Email Disclosure via Public APIGo · github.com/lin-snow/ech0 · fixed in 1.4.8-0.20260503034700-cb8d7a997dd8
- CVE-2026-79659Ech0 before 4.7.3 Server-Side Request Forgery via fetchPeerConnectInfoGo · github.com/lin-snow/ech0 · fixed in 1.4.8-0.20260503040602-091d26d2d942
- CVE-2026-79657NLTK before 3.10.3 Remote Code Execution via Unsafe Pickle DeserializationPyPI · nltk · fixed in 3.10.3
- CVE-2026-78684vLLM before 0.27.0 Denial of Service via DeepStream BackendPyPI · vllm · fixed in 0.27.0
- CVE-2026-49845Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL pathsMaven · org.apache.hive:hive-standalone-metastore
- CVE-2026-78683NLTK before 3.10.0 Remote Code Execution via Unsafe Pickle DeserializationPyPI · nltk · fixed in 3.10.0
- CVE-2026-78682NLTK before 3.10.3 SSRF Protection Bypass via ProxyPyPI · nltk · fixed in 3.10.3
- CVE-2026-78681NLTK before 3.10.3 Entity Expansion DoS via ElementTreePyPI · nltk · fixed in 3.10.3
- CVE-2026-78680NLTK before 3.10.3 Arbitrary Code Execution via Graphviz dot BinaryPyPI · nltk · fixed in 3.10.3
- CVE-2026-78679GitPython before 3.1.59 Arbitrary File Read via TagReference.createPyPI · gitpython · fixed in 3.1.59
- CVE-2026-78678GitPython before 3.1.59 Arbitrary File Read via Repo.blame()PyPI · gitpython · fixed in 3.1.59
- CVE-2026-78677GitPython before 3.1.59 Path Traversal via separate-git-dirPyPI · gitpython · fixed in 3.1.59
- CVE-2026-78676GitPython before 3.1.59 Remote Code Execution via Config InjectionPyPI · gitpython · fixed in 3.1.59
- CVE-2026-78675GitPython before 3.1.59 Local File Content Disclosure via .gitmodulesPyPI · gitpython · fixed in 3.1.59
- CVE-2026-76846Grav before 2.0.16 Information Disclosure via Twig SandboxPackagist · getgrav/grav · fixed in 2.0.16
- CVE-2026-76839Grav before 2.0.16 Information Disclosure via offsetGetPackagist · getgrav/grav · fixed in 2.0.16
- CVE-2026-72702Grav CMS before 2.0.16 Origin Validation Bypass via RefererPackagist · getgrav/grav · fixed in 2.0.16
- CVE-2026-72701Grav CMS before 2.0.16 Timing Attack via verifyNoncePackagist · getgrav/grav · fixed in 2.0.16
- CVE-2026-72698Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox BypassPackagist · getgrav/grav · fixed in 2.0.16
- CVE-2026-72697Grav CMS before 2.0.16 Path Traversal via media_directoryPackagist · getgrav/grav · fixed in 2.0.16