Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-72832Grav before 2.0.13 Stored XSS via quoted-attribute bypassPackagist · getgrav/grav · fixed in 2.0.13
- CVE-2026-72819Grav CMS before 2.0.13 Remote Code Execution via ZIP UploadPackagist · getgrav/grav · fixed in 2.0.13
- CVE-2026-72817go-chi chi 0.9.0 before 5.3.0 IP Spoofing via X-Forwarded-ForGo · github.com/go-chi/chi/middleware, github.com/go-chi/chi/v2/middleware +4 · fixed in 5.3.0
- CVE-2026-72816go-chi chi before 5.3.0 IP Spoofing via RealIP MiddlewareGo · github.com/go-chi/chi/middleware, github.com/go-chi/chi/v2/middleware +4 · fixed in 5.3.0
- CVE-2026-72815go-chi chi v5.2.1 IP Spoofing via X-Forwarded-For HeaderGo · github.com/go-chi/chi/v5, github.com/go-chi/chi/v5/middleware · fixed in 5.3.0
- CVE-2026-72814actix-files before 0.6.10 Information Disclosure via Filescrates.io · actix-files · fixed in 0.6.10
- CVE-2026-72813actix-files before 0.6.10 Denial of Service via empty Range headercrates.io · actix-files · fixed in 0.6.10
- CVE-2026-72812SiYuan before v3.7.4 Missing Authorization via refreshBacklinkGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260723002528-7d273c271ce1
- CVE-2026-72811SiYuan before v3.7.4 SQL Injection via backlink searchGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260723004839-1a5b3431d5ab
- CVE-2026-72810SiYuan before v3.7.4 Publish-Boundary Bypass via WebSocketGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260723013612-ba948639d7f6
- CVE-2025-71405go-chi chi before v5.2.2 Open Redirect via RedirectSlashesGo · github.com/go-chi/chi/v5 · fixed in 5.2.2
- CVE-2026-73305Budibase: Privilege escalation via public role assignment API missing app-level authorizationnpm · @budibase/server
- CVE-2026-73304Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Usersnpm · @budibase/server · fixed in 3.39.25
- CVE-2026-73408Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connectornpm · @budibase/server
- CVE-2026-73302Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verifiednpm · @budibase/server
- CVE-2026-73489Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode recordscrates.io · russh · fixed in 0.62.4
- CVE-2026-73421NextAuth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)npm · next-auth · fixed in 5.0.0-beta.32
- CVE-2026-73417JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)PyPI · jupyterlab · fixed in 4.5.10, 4.6.2
- CVE-2026-73416jupyterlab: PyPI extension blocklist package-name canonicalization bypassPyPI · jupyterlab · fixed in 4.6.2, 4.5.10
- CVE-2026-73428Trix: Stored XSS via HTMLParser attribute injection on pastenpm · trix · fixed in 2.1.18
- CVE-2026-73420NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypassnpm · @auth/core, next-auth · fixed in 0.41.3, 4.24.15, 5.0.0-beta.32
- CVE-2026-73843OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIsGo · github.com/openchoreo/openchoreo · fixed in 1.0.2, 1.1.2
- CVE-2026-73842OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutationGo · github.com/openchoreo/openchoreo · fixed in 1.0.3, 1.1.3, 1.2.0
- CVE-2026-56860Avoid quadratic complexity in resolvePath in net/urlGo · stdlib · fixed in 1.25.13, 1.26.6, 1.27.0-rc.3
- CVE-2026-56864Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdbGo · golang.org/x/mod, toolchain · fixed in 0.40.0, 1.25.13, 1.26.6 and more
- CVE-2026-56865Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlogGo · golang.org/x/mod, toolchain · fixed in 0.40.0, 1.25.13, 1.26.6 and more
- CVE-2026-56858Fix Javascript regexp context tracking in html/templateGo · stdlib · fixed in 1.25.13, 1.26.6, 1.27.0-rc.3
- CVE-2026-56862Limit handshake messages we are willing to accept post-handshake in crypto/tlsGo · stdlib · fixed in 1.25.13, 1.26.6, 1.27.0-rc.3
- CVE-2026-56853Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/httpGo · stdlib · fixed in 1.25.13, 1.26.6, 1.27.0-rc.3
- CVE-2026-56859Add recursion depth guard during decode in encoding/xmlGo · stdlib · fixed in 1.25.13, 1.26.6, 1.27.0-rc.3