Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-73627JupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement BypassPyPI · jupyterlab · fixed in 4.6.2, 4.5.10
- CVE-2026-73626JupyterLab before 4.6.2 Authentication Bypass via PyPIExtensionManagerPyPI · jupyterlab · fixed in 4.6.2, 4.5.10
- CVE-2026-73625GitPython before 3.1.54 Remote Code Execution via kwarg value smugglingPyPI · gitpython · fixed in 3.1.54
- CVE-2026-73624GitPython before 3.1.54 Arbitrary File Overwrite via diffPyPI · gitpython · fixed in 3.1.54
- CVE-2026-73623GitPython before 3.1.54 Remote Code Execution via --templatePyPI · gitpython · fixed in 3.1.54
- CVE-2026-73622GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add()PyPI · gitpython · fixed in 3.1.55
- CVE-2026-73621GitPython before 3.1.56 Arbitrary File Truncation via Commit.countPyPI · gitpython · fixed in 3.1.56
- CVE-2026-73620GitPython before 3.1.57 Arbitrary File Overwrite and ReadPyPI · gitpython · fixed in 3.1.57
- CVE-2026-73619GitPython before 3.1.57 Arbitrary File Read via Repo.archive()PyPI · gitpython · fixed in 3.1.57
- CVE-2026-73618Budibase Server before 3.40.0 NoSQL Injection via JSON Parameternpm · @budibase/server
- CVE-2026-73617Budibase before 3.40.0 NoSQL Injection via MongoDB datasourcenpm · @budibase/server
- CVE-2026-73609SiYuan before v3.7.4 Information Disclosure via getBookmarkLabelsGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260812083335-251596fc0de2
- CVE-2026-73608SiYuan v3.7.4-alpha.2 Authorization Bypass via getAttributeViewSearchTargetGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260812083335-251596fc0de2
- CVE-2026-73607SiYuan before v3.7.4 Information Disclosure via getOutlineStorageGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260812083335-251596fc0de2
- CVE-2026-73606SiYuan before v3.7.4 Information Disclosure via getRefIDsGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260812083335-251596fc0de2
- CVE-2026-73605SiYuan before v3.7.4 Path Traversal via getUniqueFilenameGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260812083335-251596fc0de2
- CVE-2026-73604Flowise before 3.1.3 Credential Exposure via APInpm · flowise · fixed in 3.1.3
- CVE-2026-73603Flowise before 3.1.4 Credential Abuse via Text-to-Speechnpm · flowise · fixed in 3.1.4
- CVE-2026-73488Flowise before 3.1.3 IDOR via customer-default-source endpointnpm · flowise · fixed in 3.1.3
- CVE-2026-73487Flowise before 3.1.3 Prompt Injection RCE via CSV Agentnpm · flowise, flowise-components · fixed in 3.1.3
- CVE-2026-73483Flowise before 3.1.3 Sandbox Escape via Puppeteernpm · flowise, flowise-components · fixed in 3.1.3
- CVE-2026-45819baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trignpm · baseline-browser-mapping · fixed in 2.11.0
- CVE-2026-19484@fastify/busboy vulnerable to Denial of Service via oversized multipart boundarynpm · @fastify/busboy · fixed in 3.2.1
- CVE-2026-19481@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part headernpm · @fastify/busboy · fixed in 3.2.1
- CVE-2026-48791Sigstore Java has a vulnerability with bundle verification of integratedTimeMaven · dev.sigstore:sigstore-java · fixed in 2.1.0
- CVE-2026-49473@cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulationnpm · @cedar-policy/authorization-for-expressjs · fixed in 0.3.0
- CVE-2026-47718FUXA provides guest and invalid-token access to protected read APIs in secure modenpm · fuxa-server · fixed in 1.3.1
- CVE-2026-47717FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurationsnpm · fuxa-server · fixed in 1.3.1
- CVE-2026-73501kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc DefaultGo · github.com/getkin/kin-openapi · fixed in 0.144.0
- CVE-2026-73500etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadlineGo · go.etcd.io/etcd/client/pkg/v3, go.etcd.io/etcd/v3 · fixed in 3.5.33, 3.6.14, 3.7.1