Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-33818Enforce maximum recursion depth in encoding/asn1Go · encoding/asn1 · fixed in 1.25.13, 1.26.6, 1.27.0-rc.3
- CVE-2026-73841OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpointsGo · github.com/openchoreo/openchoreo · fixed in 1.2.3, 1.1.6
- CVE-2026-72855Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and RESTnpm · @budibase/server
- CVE-2026-72849Budibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRFnpm · @budibase/server
- CVE-2026-73840OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)Go · github.com/openchoreo/openchoreo · fixed in 1.0.3, 1.1.3, 1.2.0-rc.2
- CVE-2026-73667OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged podsGo · github.com/openchoreo/openchoreo · fixed in 1.0.4, 1.1.4, 1.2.0-rc.2
- CVE-2026-73654Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoSnpm · @trigger.dev/core · fixed in 4.5.6
- CVE-2026-45774compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path TraversalPyPI · compliance-trestle · fixed in 3.12.2, 4.0.3
- CVE-2026-45725compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path TraversalPyPI · compliance-trestle · fixed in 3.12.2, 4.0.3
- CVE-2026-48099WsgiDAV encoded dot segments can escape filesystem share rootsPyPI · wsgidav · fixed in 4.3.4
- CVE-2026-59714Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)PyPI · open-webui · fixed in 0.10.0
- CVE-2026-49864wetty vulnerable to DOM XSS via file-download filenamenpm · wetty · fixed in 3.0.4
- CVE-2026-73653Vitest: Browser Mode provider commands bypass the file-access permission gatenpm · @vitest/browser · fixed in 4.1.10, 3.2.7, 5.0.0-beta.6
- CVE-2026-73652vantage6: Algorithm developer can edit another developer's algorithm that is pending / under reviewPyPI · vantage6
- CVE-2026-73651TypeORM: migration:generate template-literal code injectionnpm · typeorm · fixed in 0.3.31, 1.1.0
- CVE-2026-73650SVGO: removeScripts plugin leaves some executable scripts intactnpm · svgo · fixed in 2.8.3, 3.3.4, 4.0.2
- CVE-2026-73649Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of CVE-2026-44966 fix)npm · velocityjs · fixed in 2.1.7
- CVE-2026-73648rails-html-sanitizer: Possible XSS vulnerability with certain configurationsRubyGems · rails-html-sanitizer · fixed in 1.7.1
- CVE-2026-73647Quasar Framework: Prototype pollution in Quasar extend() utilitynpm · quasar · fixed in 2.22.0
- CVE-2026-73645OpenZeppelin Confidential Contracts ERC7984ERC20Wrapper: once a wrapper is filled, subsequent wrap requests do not revert and result in loss of funds.npm · @openzeppelin/confidential-contracts · fixed in 0.3.1
- CVE-2026-19730Podman: podman: quadlet install --replace non-truncating write retains removed host-access directivesGo · github.com/containers/podman, github.com/containers/podman/v2 +3 · fixed in 5.8.6
- CVE-2026-73644OpenDJ: Authorization bypass in SASL PLAIN allowing a `proxied-auth` holder to impersonate any resolvable non-root user without an ACI proxy grantMaven · org.openidentityplatform.opendj:opendj-server-legacy · fixed in 5.1.2
- CVE-2026-73643js-yaml: Exponential parsing time in the flow collections leads to denial of servicenpm · js-yaml · fixed in 5.2.2
- CVE-2026-73569fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limitsnpm · fast-xml-parser · fixed in 5.10.1
- CVE-2026-73568py-libp2p: yamux connection DoS via oversized data framePyPI · libp2p
- CVE-2026-73567sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clocknpm · sm-crypto · fixed in 0.5.0
- CVE-2026-73566node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selectionnpm · tar · fixed in 7.5.21
- CVE-2026-73565@hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshakenpm · @hono/node-server · fixed in 2.0.10
- CVE-2026-73564frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer OverflowGo · github.com/fatedier/frp · fixed in 0.70.1
- CVE-2026-73563Backstage: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass in `@backstage/plugin-auth-backend`npm · @backstage/plugin-auth-backend · fixed in 0.29.2