Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-68922MobSF: Arbitrary File Read via Path Traversal in ZIP UploadsPyPI · mobsf · fixed in 4.5.1
- CVE-2026-68924MobSF: Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK ExtractionPyPI · mobsf · fixed in 4.5.1
- CVE-2026-54570AngleSharp: HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point BypassNuGet · anglesharp · fixed in 1.5.0
- CVE-2026-54552sh _uid does not drop supplementary groups (incomplete privilege drop)PyPI · sh · fixed in 2.2.4
- CVE-2026-63640MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variablesnpm · magicmirror · fixed in 2.37.0
- CVE-2026-63642MagicMirror newsfeed Socket.IO notification allows blind server-side request forgerynpm · magicmirror · fixed in 2.37.0
- CVE-2026-63643MagicMirror: ssrf calendar .jsnpm · magicmirror · fixed in 2.37.0
- CVE-2026-63641MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actionsnpm · magicmirror · fixed in 2.37.0
- CVE-2026-18963Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypassMaven · org.keycloak:keycloak-services · fixed in 26.4.15, 26.6.6, 26.7.2
- CVE-2026-61634RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_maxMaven · com.rabbitmq:amqp-client · fixed in 5.33.0
- CVE-2026-63336RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITMMaven · com.rabbitmq:amqp-client · fixed in 5.33.0
- CVE-2026-63337RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loadingMaven · com.rabbitmq:amqp-client · fixed in 5.33.0
- CVE-2026-69220RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoSMaven · com.rabbitmq:amqp-client · fixed in 5.33.1
- CVE-2026-69219RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocationMaven · com.rabbitmq:amqp-client · fixed in 5.33.1
- CVE-2026-63335RabbitMQ Java client malformed body frame triggers raw command assembler exceptionMaven · com.rabbitmq:amqp-client · fixed in 5.31.0
- CVE-2026-55839Kestra: Stored XSS via custom Markdown [[link]] attribute injectionMaven · io.kestra:kestra · fixed in 1.3.24
- CVE-2026-75915CodeWhale before 0.8.64 Environment Variable Leak via js_executionnpm · codewhale, deepseek-tui · fixed in 0.8.64, 0.8.41
- CVE-2026-75914CodeWhale before 0.8.64 Path Traversal via image_analyze symlinknpm · codewhale, deepseek-tui · fixed in 0.8.64, 0.8.41
- CVE-2026-75913CodeWhale before 0.8.64 Argument Injection via git_shownpm · codewhale, deepseek-tui · fixed in 0.8.64, 0.8.41
- CVE-2026-75912CodeWhale before 0.8.64 Argument Injection via git_blamenpm · codewhale, deepseek-tui · fixed in 0.8.64, 0.8.41
- CVE-2026-75911CodeWhale before 0.8.64 Remote Code Execution via allow_shellnpm · codewhale, deepseek-tui · fixed in 0.8.64, 0.8.41
- CVE-2026-75859CodeWhale before 0.8.64 Arbitrary File Read via instructionsnpm · codewhale, deepseek-tui · fixed in 0.8.64, 0.8.41
- CVE-2026-75858CodeWhale rlm_eval before 0.8.64 Remote Code Executionnpm · codewhale, deepseek-tui · fixed in 0.8.64, 0.8.41
- CVE-2026-75857CodeWhale before 0.8.64 Privilege Escalation via exec_shell_interactnpm · codewhale, deepseek-tui · fixed in 0.8.64, 0.8.41
- CVE-2026-75856CodeWhale before 0.8.64 SSRF Bypass via DNS Pinning TOCTOUnpm · codewhale, deepseek-tui · fixed in 0.8.64, 0.8.41
- CVE-2026-62684File Browser: Share API exposes the password hash and bypass tokenGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.63.17
- CVE-2026-63328Trivy: Path Traversal in Trivy Plugin Manager Allows Arbitrary File WriteGo · github.com/aquasecurity/trivy · fixed in 0.72.0
- CVE-2026-50139goshs: Share-link ?token=… redemption races past download limitGo · goshs.de/goshs, goshs.de/goshs/v2 · fixed in 2.1.0
- CVE-2026-70657Copyparty: file/dirkey confusionPyPI · copyparty · fixed in 1.20.17
- CVE-2026-50138goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flagsGo · goshs.de/goshs, goshs.de/goshs/v2 · fixed in 2.1.0