Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-55087Etherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect)npm · ep_etherpad-lite · fixed in 3.1.0
- GHSA-QWGH-2VCV-G2F7block_buffer: panic corrupts inline buffer positioncrates.io · block_buffer · fixed in 0.12.1
- CVE-2026-55694Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File TakeoverPackagist · snipe/snipe-it · fixed in 8.6.3
- CVE-2026-55643Snipe-IT: Tenant Isolation Bypass in FMCS Floater ModePackagist · snipe/snipe-it · fixed in 8.6.3
- CVE-2026-55703Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GETPackagist · snipe/snipe-it · fixed in 8.6.3
- CVE-2026-61807Snipe-IT: Stored DOM XSS via table selected-count IDsPackagist · snipe/snipe-it · fixed in 8.6.2
- CVE-2026-55519Snipe-IT: Improper Authorization in File Deletion (IDOR)Packagist · snipe/snipe-it · fixed in 8.4.1
- CVE-2026-55482Snipe-IT: Multi-Tenancy Bypass via Bulk Asset UpdatePackagist · snipe/snipe-it · fixed in 8.4.2
- CVE-2026-55483Snipe-IT: Privilege Escalation via Missing admin Permission Check in User CreationPackagist · snipe/snipe-it · fixed in 8.6.0
- CVE-2026-50550Snipe-IT: 2FA reset privilege bypassPackagist · snipe/snipe-it · fixed in 8.5.0
- CVE-2026-49870Snipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`Packagist · snipe/snipe-it · fixed in 8.6.0
- CVE-2026-49976Snipe-IT: User Account Escalation via CSV ImportPackagist · snipe/snipe-it · fixed in 8.6.0
- CVE-2026-62680Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $refnpm · orval · fixed in 8.22.0
- CVE-2026-62682Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)npm · orval · fixed in 8.21.0
- CVE-2026-72717Orval: Import-time RCE via schema default -> zod module-level template literalnpm · orval · fixed in 8.21.0
- CVE-2026-71867Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generatornpm · orval · fixed in 8.21.0
- CVE-2026-71868Orval: Import-time RCE via enum-typed default -> zod module-level template literalnpm · orval · fixed in 8.21.0
- CVE-2026-71865Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod clinpm · orval · fixed in 8.21.0
- CVE-2026-71869Orval: Import-time RCE via array-items default -> zod module-level template literalnpm · orval · fixed in 8.21.0
- CVE-2026-71864Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod clientnpm · orval · fixed in 8.21.0
- CVE-2026-71871Orval: Import-time RCE via header-parameter default -> zod module-level template literalnpm · orval · fixed in 8.21.0
- CVE-2026-72716Orval: Import-time RCE via query-parameter default -> zod module-level template literalnpm · orval · fixed in 8.21.0
- CVE-2026-62681Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)npm · orval · fixed in 8.21.0
- CVE-2026-71866Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod clientnpm · orval · fixed in 8.21.0
- CVE-2026-64850Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()Packagist · getgrav/grav · fixed in 2.0.7
- CVE-2026-62673Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystemsPackagist · getgrav/grav · fixed in 2.0.4
- CVE-2026-62672Grav: Authenticated ReDoS via regex_replace in Twig SandboxPackagist · getgrav/grav · fixed in 2.0.4
- CVE-2026-62669Grav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending ChallengePackagist · getgrav/grav · fixed in 2.0.4
- CVE-2026-61842Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)Packagist · getgrav/grav · fixed in 2.0.2
- CVE-2026-61690Grav: Decompression Bomb via ZipArchiver - Missing Extraction LimitsPackagist · getgrav/grav · fixed in 2.0.1