Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-74893openssl_encrypt before 1.4.0 JWT Token Forgery via Hardcoded SecretsPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74892openssl_encrypt before 1.4.0 Hardcoded Secret KeyPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74891openssl_encrypt before 1.4.0 Hardcoded Database CredentialsPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74890openssl_encrypt before 1.4.0 HMAC Authentication Bypass via Environment VariablePyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74889openssl_encrypt before 1.4.0 Weak Key Derivation via HKDFPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74888openssl_encrypt before 1.4.0 Non-Standard PBKDF2 Key DerivationPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74887openssl_encrypt before 1.4.0 Insecure Random Import in PQC ModulePyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74886openssl_encrypt before 1.4.0 Plugin Import Guard BypassPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74885openssl_encrypt before 1.4.0 Logging Bug and Race ConditionPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74884openssl_encrypt before 1.4.0 Path Traversal via plugin_idPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74883openssl_encrypt before 1.4.0 Sandbox Bypass via pathlib and ioPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74882openssl_encrypt before 1.4.0 Insecure Default ConfigurationPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74881openssl_encrypt before 1.4.0 CORS Misconfiguration via Wildcard OriginsPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74880openssl_encrypt before 1.4.0 Token Leakage via Query ParametersPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74879openssl_encrypt before 1.4.0 Information Disclosure via /ready endpointPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74878openssl_encrypt before 1.4.0 TOTP Rate Limiter BypassPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74877openssl_encrypt before 1.4.0 Missing Ownership Verification via revoke_keyPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74876openssl_encrypt before 1.4.0 Unverified Key Bundle EncryptionPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74875openssl_encrypt before 1.4.0 Schema Validation BypassPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74874openssl_encrypt before 1.4.0 Weak PRNG Steganography Pixel SelectionPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74873openssl_encrypt before 1.4.0 Password Exposure via CLI ArgumentPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74872openssl_encrypt before 1.4.0 Arbitrary Code Execution via WhirlpoolPyPI · openssl-encrypt · fixed in 1.4.0
- CVE-2026-74871openssl_encrypt before 1.4.6 KDF Bypass via Sequential-XORPyPI · openssl-encrypt · fixed in 1.4.6
- CVE-2026-74870openssl_encrypt before 1.4.8 Hardware Pepper Information DisclosurePyPI · openssl-encrypt · fixed in 1.4.7
- CVE-2026-74802SiYuan 3.7.3 Cross-Site WebSocket Hijacking via network proxyGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260803045322-cb67e0b4fab5
- CVE-2026-74797OpenTofu before 1.11.4 Denial of Service via malicious zipGo · github.com/opentofu/opentofu · fixed in 1.11.4
- CVE-2026-74796OpenTofu before 1.11.7 Symlink Following Path TraversalGo · github.com/opentofu/opentofu · fixed in 1.11.7, 1.10.10
- CVE-2026-74795Scriban before 6.6.0 Denial of Service via Uncontrolled RecursionNuGet · scriban, scriban.signed · fixed in 6.6.0
- CVE-2026-74794Scriban before 6.6.0 Denial of Service via Infinite RecursionNuGet · scriban, scriban.signed · fixed in 6.6.0
- CVE-2026-74792Scriban before 7.0.0 Stack Overflow via nested array initializersNuGet · scriban, scriban.signed · fixed in 7.0.0