Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-72802SiYuan before v3.7.4 Information Disclosure via resolveAssetPathGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260724095509-eee3410aa131
- CVE-2026-72801SiYuan before v3.7.4 Information Disclosure via Encryption Key MaterialGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260724102025-3bc014c7dc32
- CVE-2026-72800SiYuan before v3.7.4 Information Disclosure via Unfiltered APIGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260724103335-f36331956ae9
- CVE-2026-72799SiYuan before v3.7.4 Information Disclosure via Path ResolutionGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260724112156-5bae0926b896
- CVE-2026-72798SiYuan before v3.7.4 Information Disclosure via renderAttributeViewGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260724121519-426991d155c0
- CVE-2026-72797SiYuan before v3.7.4 Information Disclosure via getEncryptedNotebookStatusGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260724123622-8fb1b5766093
- CVE-2026-72796SiYuan before v3.7.4 Access Control Bypass via Static RoutesGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260725122641-34be6c0bb073
- CVE-2026-72795SiYuan before v3.7.4 Information Disclosure via Embed BlockGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260725125659-1ca1c3c9d94b
- CVE-2026-72794siyuan before v3.7.4 Session Cookie Key Disclosure via getConfGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260725123945-77421530be4a
- CVE-2026-72793SiYuan before v3.7.4 Information Disclosure via /api/system/getConfGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260725132049-2d8b98395a91
- CVE-2026-72792SiYuan before v3.7.4 Information Disclosure via Tag APIGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260726002639-4515fa257cfa
- CVE-2026-72791SiYuan v3.7.4-alpha.1 Information Disclosure via getAttributeViewFieldViewsGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260726004013-64c26e74bb82
- CVE-2026-72790SiYuan before v3.7.4 Information Disclosure via getNotebookInfoGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260726005141-9edb321eb451
- CVE-2026-72789SiYuan before v3.7.4 Authentication Bypass via Encrypted NotebooksGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260726020813-a25c2dd06aae
- CVE-2026-72788SiYuan before v3.7.4 Information Disclosure via UILayout FilterGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260812083335-251596fc0de2
- CVE-2026-72787Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft NamePackagist · craftcms/cms · fixed in 5.10.8
- CVE-2026-72786Craft CMS 5.0.0-RC1 before 5.10.8 Authentication Bypass via Password ResetPackagist · craftcms/cms · fixed in 5.10.8
- CVE-2026-73406Budibase: Unauthenticated user information disclosure via public tenant user lookup endpointnpm · @budibase/server
- CVE-2026-73308Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Buildersnpm · @budibase/server
- CVE-2026-73307Budibase: SSRF via bare fetch() in uploadUrl during AI table generationnpm · @budibase/server
- CVE-2026-73306Budibase: Account Enumeration via Login Lockout Response Differentialnpm · @budibase/server
- CVE-2026-18679Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configuredGo · github.com/kumahq/kuma, github.com/kumahq/kuma/v2 · fixed in 2.7.26, 2.9.16, 2.11.14 and more
- CVE-2026-73303Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)npm · @budibase/server
- CVE-2026-18678Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configuredGo · github.com/kumahq/kuma, github.com/kumahq/kuma/v2 · fixed in 2.7.26, 2.11.14, 2.12.11 and more
- CVE-2026-18676Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost adminGo · github.com/kumahq/kuma, github.com/kumahq/kuma/v2 · fixed in 2.7.25, 2.9.15, 2.11.13 and more
- CVE-2026-73301Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappingsnpm · @budibase/server
- CVE-2026-73300Budibase: SQL Injection via `multipleStatements: true`npm · @budibase/server
- CVE-2026-73299Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderernpm · @prompty/core · fixed in 0.1.5, 2.0.0-beta.5
- CVE-2026-44741Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property ParameterPackagist · pimcore/admin-ui-classic-bundle · fixed in 2.3.6, 1.7.18
- CVE-2026-73295Material for MkDocs: DOM XSS in search suggestions via query parameterPyPI · mkdocs-material · fixed in 9.7.7