Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-74791Scriban before 7.0.0 Authorization Bypass via Stale Include CacheNuGet · scriban, scriban.signed · fixed in 7.0.0
- CVE-2026-74790Scriban before 7.0.0 MemberFilter Bypass via TemplateContext CacheNuGet · scriban, scriban.signed · fixed in 7.0.0
- CVE-2026-74789Scriban before 7.0.0 LoopLimit Bypass via Built-in OperationsNuGet · scriban, scriban.signed · fixed in 7.0.0
- CVE-2026-74788Scriban before 7.0.0 Denial of Service via string.pad_left/pad_rightNuGet · scriban, scriban.signed · fixed in 7.0.0
- CVE-2026-74787Scriban before 7.0.0 Uncontrolled Recursion via object.to_jsonNuGet · scriban, scriban.signed · fixed in 7.0.0
- CVE-2026-74786Scriban before 7.0.0 Denial of Service via Unbounded Template OutputNuGet · scriban, scriban.signed · fixed in 7.0.0
- CVE-2026-74785Scriban before 7.0.0 Denial of Service via Unbounded Resource ConsumptionNuGet · scriban, scriban.signed · fixed in 7.0.0
- CVE-2026-74784Scriban before 7.2.0 Denial of Service via array.insert_atNuGet · scriban, scriban.signed · fixed in 7.2.0
- CVE-2026-74783Scriban 6.6.0 through 7.2.0 Parser Recursion Denial of ServiceNuGet · scriban, scriban.signed · fixed in 7.2.1
- CVE-2026-73062Scriban 3.0.0 through 7.2.0 Denial of Service via Array MultiplicationNuGet · scriban, scriban.signed · fixed in 7.2.1
- CVE-2026-73061Scriban before 7.2.2 Arbitrary Property Write via TypedObjectAccessorNuGet · scriban · fixed in 7.2.2
- CVE-2024-58375OpenTofu before 1.8.3 Secret Variable Leaking via Static EvaluationGo · github.com/opentofu/opentofu · fixed in 1.8.3
- CVE-2026-73054SiYuan before v3.7.4 Authentication Bypass via WebSocketGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260731131820-67bc300b6ea6
- CVE-2026-50029js-toml has silent type confusion via falsy-primitive duplicate-key bypassnpm · js-toml · fixed in 1.1.2
- CVE-2026-50027mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/DeletePyPI · mcp-memory-service · fixed in 10.67.1
- CVE-2026-73846CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoningnpm · @aborruso/ckan-mcp-server · fixed in 0.4.112
- CVE-2026-73845CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)npm · @aborruso/ckan-mcp-server · fixed in 0.4.112
- CVE-2026-73844CKAN MCP Server: Information disclosure via verbose error reflectionnpm · @aborruso/ckan-mcp-server · fixed in 0.4.112
- CVE-2026-47192kas's late signature validation may allow unnoticed repository manipulationsPyPI · kas · fixed in 5.3
- CVE-2026-46603Excessive memory allocation during VP8L decoding in golang.org/x/imageGo · golang.org/x/image · fixed in 0.45.0
- CVE-2026-47191kas checks out SHA-like git branches as valid commitsPyPI · kas · fixed in 5.3
- CVE-2026-49989CrateDB's Blob HTTP handler bypasses authorizationMaven · io.crate:crate · fixed in 6.2.8, 6.3.2
- CVE-2026-49826Concourse login flow has an open redirect issueGo · github.com/concourse/concourse · fixed in 1.6.1-0.20260526150512-ac60be5f0435
- CVE-2026-49986Cortex has Untrusted Project Bootstrap Code Execution via `CLAUDE_PROJECT_DIR`PyPI · neuro-cortex-memory · fixed in 3.18.0
- CVE-2026-46380compliance-trestle Vulnerable to SSRF in Remote Fetching SubsystemPyPI · compliance-trestle · fixed in 3.12.2, 4.0.3
- CVE-2026-46439compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)PyPI · compliance-trestle · fixed in 3.12.2, 4.0.3
- CVE-2026-73630SiYuan before v3.7.4 Information Disclosure via authFilePublishAccessGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260731093152-c7522b8db586
- CVE-2026-73051actix-http before 3.12.1 HTTP Request Smuggling via CL.TEcrates.io · actix-http · fixed in 3.12.1
- CVE-2026-73049SiYuan before v3.7.4 Information Disclosure via getAttributeViewBacklinksGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260730150429-5b42614311b0
- CVE-2026-72859Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URLnpm · @budibase/server