Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-114540Domain - Moderately critical - Access bypass - SA-CONTRIB-2026-238Packagist · drupal/domain · fixed in 3.0.2
- CVE-2026-114541Frontend Editing - Moderately critical - Cross-Site Request Forgery (CSRF) - SA-CONTRIB-2026-240Packagist · drupal/frontend_editing · fixed in 1.9.3
- CVE-2026-114553Frontend Editing - Less critical - Access bypass - SA-CONTRIB-2026-241Packagist · drupal/frontend_editing · fixed in 1.9.3
- CVE-2026-114542Simple OAuth (OAuth2) & OpenID Connect - Moderately critical - Access bypass - SA-CONTRIB-2026-242Packagist · drupal/simple_oauth · fixed in 6.1.3
- CVE-2026-114544Media Bulk Upload - Moderately critical - Access bypass - SA-CONTRIB-2026-243Packagist · drupal/media_bulk_upload · fixed in 3.0.6
- CVE-2026-114545Fullcalendar View - Moderately critical - Access bypass - SA-CONTRIB-2026-244Packagist · drupal/fullcalendar_view · fixed in 5.2.6
- CVE-2026-114546Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-245Packagist · drupal/media_alias_display · fixed in 2.1.2, 3.0.2
- CVE-2026-114547TinyPNG - Moderately critical - Information disclosure - SA-CONTRIB-2026-246Packagist · drupal/tinypng · fixed in 2.0.2
- CVE-2026-114548ImageAPI Optimize WebP - Moderately critical - Information disclosure - SA-CONTRIB-2026-247Packagist · drupal/imageapi_optimize_webp · fixed in 2.1.2
- CVE-2026-114554AI File to Text - Moderately critical - Access bypass - SA-CONTRIB-2026-251Packagist · drupal/ai_file_to_text · fixed in 1.0.1
- CVE-2026-114573Monster Menus - Critical - PHP object injection - SA-CONTRIB-2026-253Packagist · drupal/monster_menus · fixed in 9.5.6
- CVE-2026-118539Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254Packagist · drupal/commerce · fixed in 2.41.0, 3.3.13
- CVE-2026-118540Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-255Packagist · drupal/commerce · fixed in 2.41.0, 3.2.0
- CVE-2026-118541Commerce Core - Less critical - Access bypass - SA-CONTRIB-2026-256Packagist · drupal/commerce · fixed in 2.41.0, 3.3.13
- CVE-2026-118542Commerce Core - Moderately critical - Access bypass - SA-CONTRIB-2026-257Packagist · drupal/commerce · fixed in 2.41.0, 3.3.13
- CVE-2026-118543Commerce Core - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-258Packagist · drupal/commerce · fixed in 2.41.0, 3.3.13
- CVE-2026-118544Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-259Packagist · drupal/commerce · fixed in 2.41.0, 3.3.13
- CVE-2026-118555Commerce License - Moderately critical - Access bypass - SA-CONTRIB-2026-260Packagist · drupal/commerce_license · fixed in 3.1.1
- CVE-2026-118556Commerce Shipping - Moderately critical - Access bypass - SA-CONTRIB-2026-261Packagist · drupal/commerce_shipping · fixed in 2.16.0, 3.0.6
- CVE-2026-118557Commerce Shipping - Less critical - Access bypass - SA-CONTRIB-2026-262Packagist · drupal/commerce_shipping · fixed in 2.16.0, 3.0.6
- CVE-2026-118558Commerce Stripe - Critical - Cross-site request forgery - SA-CONTRIB-2026-263Packagist · drupal/commerce_stripe · fixed in 2.2.3
- CVE-2026-118559Commerce Stripe - Moderately critical - Improper verification of cryptographic signature - SA-CONTRIB-2026-264Packagist · drupal/commerce_stripe · fixed in 1.4.0, 2.2.3
- CVE-2026-118560Commerce Stripe - Moderately critical - Cross site scripting - SA-CONTRIB-2026-265Packagist · drupal/commerce_stripe · fixed in 2.2.3
- CVE-2026-118545AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-266Packagist · drupal/ai · fixed in 1.4.11, 1.5.2
- CVE-2026-118546AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-267Packagist · drupal/ai · fixed in 1.4.11, 1.5.2
- CVE-2026-118548AI (Artificial Intelligence) - Moderately critical - Information disclosure - SA-CONTRIB-2026-268Packagist · drupal/ai · fixed in 1.4.11, 1.5.2
- CVE-2026-118549AI (Artificial Intelligence) - Critical - Cross-site scripting - SA-CONTRIB-2026-269Packagist · drupal/ai · fixed in 1.4.11, 1.5.2
- CVE-2026-118550AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-270Packagist · drupal/ai · fixed in 1.4.11, 1.5.2
- CVE-2026-118551AI (Artificial Intelligence) - Less critical - Information Disclosure - SA-CONTRIB-2026-271Packagist · drupal/ai · fixed in 1.4.11, 1.5.2
- CVE-2026-118552AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-272Packagist · drupal/ai · fixed in 1.4.11, 1.5.2