Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-73294Semaphore U: OS Command InjectionGo · github.com/semaphoreui/semaphore · fixed in 0.0.0-20260704181911-7e8a9434bd81
- CVE-2026-73293Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collisionGo · github.com/semaphoreui/semaphore · fixed in 0.0.0-20260705182501-bb2a4e1f08c8
- CVE-2026-59244Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UIPyPI · apache-airflow, apache-airflow-core · fixed in 3.0.0, 3.3.1
- CVE-2026-58076Apache Airflow: Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables…PyPI · apache-airflow, apache-airflow-core · fixed in 3.3.1
- CVE-2026-59242Apache Airflow: Arbitrary airflow. class instantiation on the API server via the XCom deserialize endpointPyPI · apache-airflow, apache-airflow-core · fixed in 3.0.0, 3.3.1
- CVE-2026-73292Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmationGo · github.com/semaphoreui/semaphore · fixed in 0.0.0-20260707190631-c59c3dc9035b
- CVE-2026-54183Apache Airflow: Airflow Variables were not masked in the UI for authenticated usersPyPI · apache-airflow, apache-airflow-core · fixed in 3.0.0, 3.3.1
- CVE-2026-67260Apache Airflow: DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserializationPyPI · apache-airflow, apache-airflow-core · fixed in 3.3.1
- CVE-2026-67587Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadgetPyPI · apache-airflow, apache-airflow-core · fixed in 3.3.1
- CVE-2026-65017Apache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass)PyPI · apache-airflow, apache-airflow-core · fixed in 3.3.1
- CVE-2026-68968Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill idPyPI · apache-airflow, apache-airflow-core · fixed in 3.0.0, 3.3.1
- CVE-2026-68969Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartextPyPI · apache-airflow, apache-airflow-core · fixed in 3.0.0, 3.3.1
- CVE-2026-68970Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UIPyPI · apache-airflow, apache-airflow-core · fixed in 3.0.0, 3.3.1
- CVE-2026-68971Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpointsPyPI · apache-airflow, apache-airflow-core · fixed in 3.0.0, 3.3.1
- CVE-2026-68076Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment ConnectionPyPI · apache-airflow, apache-airflow-core · fixed in 3.0.0, 3.3.1
- CVE-2026-73262Prowler: Stored XSS in HTML reports through unescaped cloud resource tagsPyPI · prowler, prowler-cloud · fixed in 5.37.0
- CVE-2026-49349regclient may leak authentication credentials to external blob storesGo · github.com/regclient/regclient · fixed in 0.11.5
- CVE-2026-49262Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxyPackagist · aimeos/pagible · fixed in 0.10.4
- CVE-2026-47234Admidio writes session IDs and auto-login cookie values to application logsPackagist · admidio/admidio · fixed in 5.0.10
- CVE-2026-47233Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024Packagist · admidio/admidio · fixed in 5.0.10
- CVE-2026-47232Admidio PKCS#12 private key export action lacks CSRF protectionPackagist · admidio/admidio · fixed in 5.0.10
- CVE-2026-47231Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private foldersPackagist · admidio/admidio · fixed in 5.0.10
- CVE-2026-47230Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploadersPackagist · admidio/admidio · fixed in 5.0.10
- CVE-2026-47229Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validationPackagist · admidio/admidio · fixed in 5.0.10
- CVE-2026-47228Admidio's CSRF in registration `send_login` mode resets arbitrary user passwordsPackagist · admidio/admidio · fixed in 5.0.10
- CVE-2026-47227Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php`Packagist · admidio/admidio · fixed in 5.0.10
- CVE-2026-47226Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privilegesPackagist · admidio/admidio · fixed in 5.0.10
- CVE-2026-68868Apache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every team's Connections and VariablesPyPI · apache-airflow-providers-google · fixed in 22.3.0
- CVE-2026-9318tablib versions prior to 3.10.0 Stored XSS via HTML Export Dataset TitlePyPI · tablib · fixed in 3.10.0
- CVE-2026-73247Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadataMaven · io.kestra:core, io.kestra:kestra-core · fixed in 2.0.0