Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-63669ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtreenpm · apostrophe · fixed in 4.32.0
- CVE-2026-48053Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewsetPyPI · kolibri · fixed in 0.19.4
- CVE-2026-59903Netty: Cache Poisoning and Information Disclosure via CORS Vary Header OverwriteMaven · io.netty:netty-codec-http · fixed in 4.2.17.Final, 4.1.137.Final
- CVE-2026-46345compliance-trestle - jinja has an Arbitrary File Write via Path TraversalPyPI · compliance-trestle · fixed in 3.12.2, 4.0.3
- CVE-2026-59902Netty: Memory Exhaustion in SctpMessageCompletionHandlerMaven · io.netty:netty-transport-sctp · fixed in 4.2.17.Final, 4.1.137.Final
- CVE-2026-54284sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps triggerPyPI · sqlparse · fixed in 0.6.0
- CVE-2026-59893sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)PyPI · sqlparse · fixed in 0.6.0
- CVE-2026-71491sqlparse: Quadratic O(n²) DoS in group_commentsPyPI · sqlparse · fixed in 0.6.0
- CVE-2026-59894sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashesPyPI · sqlparse · fixed in 0.6.0
- CVE-2026-73424Astro: Unauthenticated path override in the @astrojs/vercel ISR functionnpm · @astrojs/vercel · fixed in 11.0.3
- CVE-2026-68519Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)PyPI · glances · fixed in 4.5.6
- CVE-2026-62982Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injectionPyPI · glances · fixed in 4.5.6
- CVE-2026-68520Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/configPyPI · glances · fixed in 4.5.6
- CVE-2026-68517Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the WildcardPyPI · glances · fixed in 4.5.6
- CVE-2026-68518Glances: Command injection bypass of action-template sanitizer via cross-field shell-operator reconstructionPyPI · glances · fixed in 4.5.6
- CVE-2026-61666websocket-driver: Denial of service via malformed Host headerRubyGems · websocket-driver · fixed in 0.8.2
- CVE-2026-64865New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypassGo · github.com/quantumnous/new-api · fixed in 1.0.0-rc.16
- CVE-2026-71479New API: Integer overflow in quota billing yields negative charges (self-crediting)Go · github.com/quantumnous/new-api · fixed in 1.0.0-rc.18
- CVE-2026-64866New API: Admin can reset passkeys for same-level or higher-privileged usersGo · github.com/quantumnous/new-api · fixed in 1.0.0-rc.7
- CVE-2026-64868New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body loggingGo · github.com/quantumnous/new-api · fixed in 1.0.0-rc.11
- CVE-2026-64859New API: User List API Leaks Root User Access Token Leading to Privilege EscalationGo · github.com/quantumnous/new-api · fixed in 1.0.0-rc.7
- CVE-2026-73646PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosurenpm · postcss · fixed in 8.5.18
- CVE-2026-73851Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)NuGet · microsoft.openapi.kiota · fixed in 1.34.0, 1.29.1
- CVE-2026-19693extract-zip arbitrary file write outside the destination directory via a symlink at the final path componentnpm · extract-zip
- CVE-2026-74901openssl_encrypt before 1.4.0 Authentication Bypass via AES-CTR FallbackPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74900openssl_encrypt before 1.4.0 Weak Shared Secret via PQC Simulation ModePyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74899openssl_encrypt before 1.4.0 Sandbox Escape via Type HierarchyPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74896openssl_encrypt before 1.4.0 Sandbox Escape via Dunder Attribute TraversalPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74895openssl_encrypt before 1.4.0 Plugin Sandbox Bypass via Process IsolationPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74894openssl_encrypt before 1.4.0 Authentication Bypass via Bearer TokenPyPI · openssl-encrypt · fixed in 1.4.0