Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-76222GitPython before 3.1.58 Path Traversal via .gitmodules Submodule NamePyPI · gitpython · fixed in 3.1.58
- CVE-2026-76221GitPython before 3.1.58 Config Injection via option-namePyPI · gitpython · fixed in 3.1.58
- CVE-2026-76220GitPython before 3.1.58 Command Execution via split_single_char_optionsPyPI · gitpython · fixed in 3.1.58
- CVE-2026-76219GitPython before 3.1.58 Arbitrary File Overwrite via read-treePyPI · gitpython · fixed in 3.1.58
- CVE-2026-76218GitPython before 3.1.58 Remote Code Execution via Repo.initPyPI · gitpython · fixed in 3.1.58
- CVE-2026-76217GitPython before 3.1.58 Arbitrary File Read via pathspec-from-filePyPI · gitpython · fixed in 3.1.58
- CVE-2026-76216Vikunja through 2.4.0 Principal-Type Confusion via LinkSharingGo · code.vikunja.io/api · fixed in 2.5.0
- CVE-2024-58376Renovate 37.158.0 before 37.199.0 Command Injection via helmv3npm · renovate · fixed in 37.199.0
- CVE-2020-37267Renovate 19.180.0 before 23.25.1 Token Leakage via Logsnpm · renovate · fixed in 23.25.1
- CVE-2019-25766Renovate before 19.38.7 Credential Exposure via Go Modulesnpm · renovate · fixed in 19.38.7
- CVE-2026-52854mediawiki/maps: Stored XSS through the overlays parameter in the display_map parser functionPackagist · mediawiki/maps · fixed in 12.1.3
- CVE-2026-48796CefSharp: `FolderSchemeHandlerFactory` path boundary check can expose files outside the configured root folderNuGet · cefsharp.common · fixed in 148.0.90
- CVE-2026-73974linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE)PyPI · linuxfabrik-lib · fixed in 6.1.0
- CVE-2026-55426linuxfabrik-lib: Local privilege escalation using embedded commandPyPI · linuxfabrik-lib · fixed in 5.0.0
- CVE-2026-53759linuxfabrik-lib: Insecure creation of SQLite databasesPyPI · linuxfabrik-lib · fixed in 4.2.0
- CVE-2026-52817Linuxfabrik Monitoring Plugins Sudoers: /usr/bin/apt-get arguments allow privilege escalationPyPI · linuxfabrik-lib · fixed in 5.1.0
- CVE-2026-16732fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-countnpm · fastify · fixed in 5.12.1
- CVE-2026-18504fastify vulnerable to schema validation bypass via root primitive coercion mismatchnpm · fastify · fixed in 5.12.1
- CVE-2026-55593Froxlor: CSRF Vulnerability in Froxlor AJAX Endpoint — Missing Cross-Site Request Forgery ProtectionPackagist · froxlor/froxlor · fixed in 2.3.8
- CVE-2026-54347Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account TakeoverPackagist · froxlor/froxlor · fixed in 2.3.8
- CVE-2026-54348Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database ExfiltrationPackagist · froxlor/froxlor · fixed in 2.3.8
- CVE-2026-54543Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fieldsPackagist · froxlor/froxlor · fixed in 2.3.8
- CVE-2026-62988Froxlor: Credential and 2FA secret disclosure via Froxlor API endpointsPackagist · froxlor/froxlor · fixed in 2.3.8
- CVE-2026-52793Froxlor: API Authentication bypasses 2FA AuthenticationPackagist · froxlor/froxlor · fixed in 2.3.7
- CVE-2026-47721FUXA: Scheduler API missing admin check enables operator-to-admin escalation via scheduled device actionsnpm · fuxa-server
- CVE-2026-47719FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response readingnpm · fuxa-server
- CVE-2026-47720FUXA: SQL injection in TDengine DAQ connector via backslash bypass of escapeTdStringnpm · fuxa-server
- CVE-2026-52829ZEBRA: IPv4-Mapped Mempool Misbehavior Update Aborts Zebra Address Bookcrates.io · zebra-network, zebrad · fixed in 7.0.0, 4.5.0
- CVE-2026-52736ZEBRA: Block suppression via NU5 same-header body poisoning of sent-hash cachecrates.io · zebra-state, zebrad · fixed in 7.0.0, 4.5.0
- CVE-2026-52732ZEBRA: Mempool transaction admission denial via single-peer inbound queue saturationcrates.io · zebrad · fixed in 4.5.0