Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-75899fast-uri vulnerable to server-side request forgery via repeated hostname percent-decodingnpm · fast-uri · fixed in 2.4.5, 3.1.6, 4.1.3
- CVE-2026-75931fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative referencesnpm · fast-uri · fixed in 2.4.5, 3.1.6, 4.1.3
- CVE-2026-78209exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Valuesnpm · exceljs
- CVE-2026-78208exceljs through 4.4.0 Path Traversal via Unvalidated addImage filenamenpm · exceljs
- CVE-2026-78207exceljs through 4.4.0 Prototype Pollution via deepMerge Reached From Note Serializationnpm · exceljs
- CVE-2026-78206exceljs through 4.4.0 Uncontrolled Resource Consumption via Unbounded xlsx Decompressionnpm · exceljs
- CVE-2026-9769justhtml before 1.10.0 Denial of Service via deeply nested HTMLPyPI · justhtml · fixed in 1.10.0
- CVE-2026-8630justhtml before 1.12.0 Mutation XSS via Raw Text ElementsPyPI · justhtml · fixed in 1.12.0
- CVE-2026-8445justhtml before 1.12.0 Sanitizer Bypass via MarkdownPyPI · justhtml · fixed in 1.12.0
- CVE-2026-7808justhtml before 1.16.0 Multiple Security Issues via SanitizationPyPI · justhtml · fixed in 1.16.0
- CVE-2026-77088justhtml 0.9.0 through 1.21.0 Cross-Site Scripting via code-spanPyPI · justhtml · fixed in 1.22.0
- CVE-2026-6827justhtml before 1.17.0 Multiple Cross-Site Scripting VulnerabilitiesPyPI · justhtml · fixed in 1.17.0
- CVE-2026-5751justhtml before 1.14.0 Mutation XSS via custom sanitization policiesPyPI · justhtml · fixed in 1.14.0
- CVE-2026-5389justhtml before 1.13.0 XSS via code fence breakoutPyPI · justhtml · fixed in 1.13.0
- CVE-2026-5388justhtml before 1.15.0 Multiple Security IssuesPyPI · justhtml · fixed in 1.15.0
- CVE-2026-4671justhtml before 1.18.0 Denial of Service via CSS SelectorPyPI · justhtml · fixed in 1.18.0
- CVE-2026-70626NLTK before 3.9.4 Symlink Escape via CorpusReaderPyPI · nltk · fixed in 3.9.4
- CVE-2026-66393NLTK before 3.9.4 Denial of Service via JSONTaggedDecoderPyPI · nltk · fixed in 3.9.4
- CVE-2026-65915NLTK before 3.10.0 Arbitrary File Read via FileSystemPathPointerPyPI · nltk · fixed in 3.10.0
- CVE-2026-63312NLTK StreamBackedCorpusView Bypasses pathsec.ENFORCE Arbitrary File ReadPyPI · nltk · fixed in 3.10.0
- CVE-2026-63311NLTK before 3.10.0 SSRF via DNS Resolution FailurePyPI · nltk · fixed in 3.10.0
- CVE-2026-62388NLTK before 3.10.0 Insecure Default Configuration in pathsec.pyPyPI · nltk · fixed in 3.10.0
- CVE-2026-62385NLTK 3.9.4 Path Traversal via FrameNet and NKJP ReadersPyPI · nltk · fixed in 3.10.0
- CVE-2026-62384NLTK FramenetCorpusReader Symlink Sandbox Bypass before 3.10.2PyPI · nltk · fixed in 3.10.2
- CVE-2026-62383nltk IPIPANCorpusReader Symlink Arbitrary File ReadPyPI · nltk · fixed in 3.10.2
- CVE-2026-71514NLTK 3.9.4 through 3.10.2 Path Traversal via CrubadanCorpusReader pathsec BypassPyPI · nltk · fixed in 3.10.3
- CVE-2026-71513NLTK 3.10.0 through 3.10.2 Remote Code Execution via AllowlistUnpickler Dotted-Name BypassPyPI · nltk · fixed in 3.10.3
- CVE-2026-62204SiYuan before v3.7.4 Plugin Overwrite via Bazaar InstallGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260808010544-26ccb40d390e
- CVE-2026-60083SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file toolGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260808051406-3542530c505f
- CVE-2026-49360Recce server has unauthenticated SQL execution that allows local file read/write through DuckDBPyPI · recce · fixed in 1.50.0