Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-49825lxml: javascript: URL bypass in Cleaner via xlink:hrefPyPI · lxml-html-clean · fixed in 0.4.5
- CVE-2026-55558aiosmtplib: STARTTLS response injectionPyPI · aiosmtplib · fixed in 5.1.2
- CVE-2026-63123Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media rootnpm · @tinacms/cli · fixed in 2.5.2
- CVE-2026-59992Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)npm · next-tinacms-azure, next-tinacms-cloudinary +2 · fixed in 14.0.4, 26.0.4, 23.0.4
- CVE-2026-75595Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContextMaven · io.netty:netty-handler · fixed in 4.2.17.Final, 4.1.137.Final
- CVE-2026-75596Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsingMaven · io.netty:netty-handler · fixed in 4.2.17.Final, 4.1.137.Final
- CVE-2026-69222LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the processnpm · liquidjs · fixed in 10.27.2
- CVE-2026-61556LiquidJS: An infinite loop vulnerability in `strip_html` filternpm · liquidjs · fixed in 10.27.1
- CVE-2026-54491Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch pathsPackagist · phanan/koel · fixed in 9.7.1
- CVE-2026-54493Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio StationsPackagist · phanan/koel · fixed in 9.7.0
- CVE-2026-54494Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4Packagist · phanan/koel · fixed in 9.7.1
- CVE-2026-54492Koel: Authenticated Blind SSRF via Subsonic Podcast Channel CreationPackagist · phanan/koel · fixed in 9.7.0
- CVE-2026-61711BuildKit: Custom frontend could bypass Seccomp/AppArmorGo · github.com/moby/buildkit · fixed in 0.31.1
- CVE-2026-61712BuildKit: Possible runtime DoS via unbounded group parsingGo · github.com/moby/buildkit · fixed in 0.31.1
- CVE-2026-63188logto-tunnel serves files outside --experience-path via path traversalnpm · @logto/tunnel · fixed in 0.3.9
- CVE-2026-55086Etherpad: Import/export use Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwritenpm · ep_etherpad-lite · fixed in 3.1.0
- CVE-2026-55090Etherpad: Stored XSS in HTML export via unescaped attribute-pool valuesnpm · ep_etherpad-lite · fixed in 3.3.0
- CVE-2026-55088Etherpad: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author tokennpm · ep_etherpad-lite · fixed in 3.1.0
- CVE-2026-55087Etherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect)npm · ep_etherpad-lite · fixed in 3.1.0
- GHSA-QWGH-2VCV-G2F7block_buffer: panic corrupts inline buffer positioncrates.io · block_buffer · fixed in 0.12.1
- CVE-2026-55694Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File TakeoverPackagist · snipe/snipe-it · fixed in 8.6.3
- CVE-2026-55643Snipe-IT: Tenant Isolation Bypass in FMCS Floater ModePackagist · snipe/snipe-it · fixed in 8.6.3
- CVE-2026-55703Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GETPackagist · snipe/snipe-it · fixed in 8.6.3
- CVE-2026-61807Snipe-IT: Stored DOM XSS via table selected-count IDsPackagist · snipe/snipe-it · fixed in 8.6.2
- CVE-2026-55519Snipe-IT: Improper Authorization in File Deletion (IDOR)Packagist · snipe/snipe-it · fixed in 8.4.1
- CVE-2026-55482Snipe-IT: Multi-Tenancy Bypass via Bulk Asset UpdatePackagist · snipe/snipe-it · fixed in 8.4.2
- CVE-2026-55483Snipe-IT: Privilege Escalation via Missing admin Permission Check in User CreationPackagist · snipe/snipe-it · fixed in 8.6.0
- CVE-2026-50550Snipe-IT: 2FA reset privilege bypassPackagist · snipe/snipe-it · fixed in 8.5.0
- CVE-2026-49870Snipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`Packagist · snipe/snipe-it · fixed in 8.6.0
- CVE-2026-49976Snipe-IT: User Account Escalation via CSV ImportPackagist · snipe/snipe-it · fixed in 8.6.0