Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-73499etcd: Watch API authorization bypass via open-ended range requestsGo · go.etcd.io/etcd/server/v3, go.etcd.io/etcd/v3 · fixed in 3.5.33, 3.6.14, 3.7.1
- CVE-2026-73498MCP Atlassian is a Model Context Protocol (MCP): Arbitrary file read via missing path validation in confluence_upload_attachmentPyPI · mcp-atlassian · fixed in 0.22.0
- CVE-2026-73495blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)Maven · org.http4s:blaze-http_2.12, org.http4s:blaze-http_2.13 +1 · fixed in 0.23.18, 1.0.0-M42
- CVE-2026-73493http4s-blaze-server: Unbounded WebSocket message aggregationMaven · org.http4s:http4s-blaze-server_2.12, org.http4s:http4s-blaze-server_2.13 +1 · fixed in 0.23.18, 1.0.0-M42
- CVE-2026-73492Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolonsRubyGems · loofah · fixed in 2.25.2
- CVE-2026-73491Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character referencesRubyGems · loofah · fixed in 2.25.2
- CVE-2026-73490Loofah: SVG `href` attribute bypasses local-reference restrictionRubyGems · loofah · fixed in 2.25.2
- CVE-2026-73430Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)crates.io · russh · fixed in 0.62.4
- CVE-2026-73429Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)crates.io · russh · fixed in 0.62.4
- CVE-2026-73427Trix: XSS via JSON deserialization bypass in drag-and-drop (Level0InputController)npm · trix · fixed in 2.1.18
- CVE-2026-73425@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escapednpm · @astrojs/netlify · fixed in 8.1.2
- CVE-2026-73423Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misorderednpm · astro · fixed in 7.0.6
- CVE-2026-73422Astro: Reflected XSS via unescaped View Transition animation propertiesnpm · astro · fixed in 7.1.0
- CVE-2026-73419NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created themnpm · @auth/core, next-auth · fixed in 0.41.3, 5.0.0-beta.32, 4.24.15
- CVE-2026-73418NextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headersnpm · @auth/core, next-auth · fixed in 0.41.3, 5.0.0-beta.32, 4.24.15
- CVE-2026-73415jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tabPyPI · jupyterlab · fixed in 4.6.2, 4.5.10
- CVE-2026-73414Shescape: Shell injection via unescaped parentheses on Windows with CMDnpm · shescape · fixed in 2.1.14, 3.0.1
- CVE-2026-73413Shescape: Quadratic-time denial of service in flag-protectionnpm · shescape · fixed in 2.1.14, 3.0.1
- CVE-2026-73412Shescape: Path disclosure on Unix with Zshnpm · shescape · fixed in 2.1.14, 3.0.1
- CVE-2026-73411Shescape: Home-directory disclosure in assignment context on Unix with Dashnpm · shescape · fixed in 2.1.14, 3.0.1
- GHSA-JWJP-4649-V8JPSIPSorcery vulnerable to Denial of Service via out-of-bounds read in SCTP SACK chunk parsingNuGet · sipsorcery · fixed in 10.0.14
- CVE-2026-73409Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFilenpm · @budibase/server
- CVE-2026-73407Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak (bypass of CVE-2026-48152))npm · @budibase/server
- CVE-2026-72809SiYuan before v3.7.4 Authentication Bypass via Localhost TrustGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260723031701-9c16e9851f0b
- CVE-2026-72808SiYuan before v3.7.4 Information Disclosure via getFileAnnotationGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260723031702-509b35055940
- CVE-2026-72807SiYuan before v3.7.4 SQL Injection via queryBlocks templateGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260723035036-0a176345e02a
- CVE-2026-72806SiYuan before v3.7.4 Authentication Bypass via Attribute ViewGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260723040913-768427f20f13
- CVE-2026-72805SiYuan before v3.7.4 Information Disclosure via Block EndpointsGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260723163028-931ba693375e
- CVE-2026-72804SiYuan before v3.7.4 Authentication Bypass via Graph EndpointsGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260724091654-82e9ded423e4
- CVE-2026-72803SiYuan before v3.7.4 Information Disclosure via getBlockAttrsGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260724093256-229fdffd7e4a