Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-61789DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validationnpm · @bytebase/dbhub · fixed in 0.22.6
- CVE-2026-119713Paperclip 2026.403.0 before 2026.416.0 RCE via Execution Workspace Cleanup Commandsnpm · @paperclipai/server · fixed in 2026.416.0
- GHSA-F3FJ-9625-RV3Mcharmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated usersGo · github.com/charmbracelet/soft-serve · fixed in 0.12.3
- GHSA-FGXM-5HVV-X4VHcharmbracelet/soft-serve HTTP responses disclose the existence and names of private repositoriesGo · github.com/charmbracelet/soft-serve · fixed in 0.12.3
- RUSTSEC-2026-0425`nix-nar`: `Decoder::unpack` writes archive entries outside the destination directory (path traversal)crates.io · nix-nar · fixed in 0.6.0
- RUSTSEC-2026-0426LLVM introduces timing-vulnerable optimizations into ML-KEM and ML-DSA operations intended to be constant-timecrates.io · orion · fixed in 0.17.16, 0.18.1
- RUSTSEC-2026-0428BLAKE2b produces wrong tag when using `reset()` with a different-length keycrates.io · orion · fixed in 0.17.16, 0.18.1
- RUSTSEC-2026-0450`ocipkg`: unpacking an OCI archive can write and delete files outside the local image store (path traversal)crates.io · ocipkg · fixed in 0.4.1
- CVE-2026-119417CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransportPackagist · cakephp/cakephp · fixed in 4.5.12, 4.6.5, 5.1.9 and more
- CVE-2026-119375SQLite before 3.54.0 Information Disclosure via WAL Page Size Mismatchcrates.io · libsqlite3-sys · fixed in 0.39.0
- CVE-2026-107266Views Share - Moderately critical - Access bypass - SA-CONTRIB-2026-205Packagist · drupal/views_share · fixed in 2.0.1
- CVE-2026-107255Restrict route by IP - Critical - Access bypass - SA-CONTRIB-2026-216Packagist · drupal/restrict_route_by_ip · fixed in 1.3.1, 2.0.1
- CVE-2026-108097Drupal core - Critical - Remote code execution - SA-CORE-2026-014Packagist · drupal/core · fixed in 10.6.19, 11.3.19, 11.4.10 and more
- CVE-2026-110738Gin Admin Theme - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-219Packagist · drupal/gin · fixed in 4.1.4, 5.0.16
- CVE-2026-108515Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015Packagist · drupal/core · fixed in 10.6.19, 11.3.19, 11.4.10 and more
- CVE-2026-108514Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016Packagist · drupal/core · fixed in 10.6.19, 11.3.19, 11.4.10 and more
- CVE-2026-108099Entity List - Critical - Remote code execution - SA-CONTRIB-2026-218Packagist · drupal/entity_list · fixed in 3.0.10
- CVE-2026-114523Ffmpeg Image Toolkit - Highly critical - Remote Code Execution - SA-CONTRIB-2026-220Packagist · drupal/ffmpeg_image_toolkit · fixed in 1.0.3
- CVE-2026-114528Zero Point - Critical - Cross-site scripting - SA-CONTRIB-2026-222Packagist · drupal/zeropoint · fixed in 1.30.0, 2.0.1
- CVE-2026-114526Black Hole - Critical - Cross-site scripting - SA-CONTRIB-2026-223Packagist · drupal/black_hole · fixed in 1.26.0, 2.0.1
- CVE-2026-114525ABC - Critical - Cross-site scripting - SA-CONTRIB-2026-224Packagist · drupal/abc · fixed in 1.25.0, 2.0.1
- CVE-2026-114524Custom Formatters - Critical - Remote code execution - SA-CONTRIB-2026-225Packagist · drupal/custom_formatters · fixed in 4.2.1
- CVE-2026-114529CSV Field - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-226Packagist · drupal/csv_field · fixed in 2.0.10, 3.0.7
- CVE-2026-114530Dopup - Critical - Information disclosure - SA-CONTRIB-2026-227Packagist · drupal/dopup · fixed in 1.0.7
- CVE-2026-114531Swiper formatter - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-228Packagist · drupal/swiper_formatter · fixed in 2.1.2, 3.1.0
- CVE-2026-107260Sector Distribution - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-229Packagist · drupal/sector · fixed in 10.3.3, 10.4.2
- CVE-2026-114533Ágora Transparency Theme - Moderately critical - Information disclosure - SA-CONTRIB-2026-231Packagist · drupal/agora_theme · fixed in 1.2.3
- CVE-2026-114534Block Attributes - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-232Packagist · drupal/block_attributes · fixed in 2.1.0
- CVE-2026-114535Swiper formatter - Moderately critical - Information disclosure - SA-CONTRIB-2026-233Packagist · drupal/swiper_formatter · fixed in 2.1.2, 3.1.0
- CVE-2026-114536USWDS Paragraph Components - Moderately critical - Cross site scripting - SA-CONTRIB-2026-234Packagist · drupal/uswds_paragraph_components · fixed in 3.1.3