Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-73245Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-authMaven · io.kestra:kestra · fixed in 2.0.0
- CVE-2026-73232ffuf denial of service (OOM) via HTTP response decompression bombGo · github.com/ffuf/ffuf, github.com/ffuf/ffuf/v2 · fixed in 2.2.0
- CVE-2026-73231Faker: helpers.fake exploitable into arbritary code executionnpm · @faker-js/faker · fixed in 10.5.0
- CVE-2026-45618LiquidJS is Vulnerable to Remote Code Executionnpm · liquidjs · fixed in 10.26.0
- CVE-2026-48813Flawfinder output manipulation via untrusted filenames and source textPyPI · flawfinder · fixed in 2.0.20
- CVE-2026-48804python-socketio: Binary attachment accumulation can cause denial of servicePyPI · python-socketio · fixed in 5.16.2
- CVE-2026-73229Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requestsPyPI · djangorestframework · fixed in 3.17.2
- CVE-2026-73228Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`PyPI · djangorestframework · fixed in 3.17.2
- CVE-2026-48802python-engineio has unbound thread allocation that can cause denial of servicePyPI · python-engineio · fixed in 4.13.2
- CVE-2026-73222Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)npm · claude-code-templates · fixed in 1.29.4
- CVE-2026-48809python-engineio has possible denial of service due to maximum payload size sometimes not being enforcedPyPI · python-engineio · fixed in 4.13.2
- CVE-2026-48790turso-cli persists Turso platform JWT with world-readable (0o644) file permissionsGo · github.com/tursodatabase/turso-cli · fixed in 1.0.26
- CVE-2026-62898Microsoft QUIC Information Disclosure VulnerabilityNuGet · microsoft.netcore.app.runtime.win-arm64, microsoft.netcore.app.runtime.win-x64 +1 · fixed in 10.0.11, 9.0.19, 8.0.30
- CVE-2026-70354.NET Core Remote Code Execution VulnerabilityNuGet · microsoft.windowsdesktop.app.runtime.win-arm64, microsoft.windowsdesktop.app.runtime.win-x64 +1 · fixed in 10.0.11, 9.0.19, 8.0.30
- CVE-2026-62886.NET Elevation of Privilege VulnerabilityNuGet · microsoft.windowsdesktop.app.runtime.win-arm64, microsoft.windowsdesktop.app.runtime.win-x64 +1 · fixed in 10.0.11, 9.0.19, 8.0.30
- CVE-2026-73089Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOMnpm · browserslist · fixed in 4.28.7
- CVE-2026-62902.NET Information Disclosure VulnerabilityNuGet · microsoft.windowsdesktop.app.runtime.win-arm64, microsoft.windowsdesktop.app.runtime.win-x64 +1 · fixed in 10.0.11, 9.0.19, 8.0.30
- CVE-2026-62897.NET Framework Remote Code Execution VulnerabilityNuGet · microsoft.windowsdesktop.app.runtime.win-arm64, microsoft.windowsdesktop.app.runtime.win-x64 +1 · fixed in 10.0.11, 9.0.19, 8.0.30
- CVE-2026-73088Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)npm · browserslist · fixed in 4.28.7
- CVE-2026-73087Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcherGo · github.com/amir20/dozzle · fixed in 1.29.1-0.20260804193351-8cf7ccd5ee04
- CVE-2026-73086nanoid: Integer Overflow or Wraparoundnpm · nanoid · fixed in 3.3.12, 5.1.11
- CVE-2026-73080SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedleGo · github.com/seaweedfs/seaweedfs · fixed in 0.0.0-20260512171120-69da20bdaec9
- CVE-2026-72925SWC HTML minifier may allow script element breakout when minifying embedded JSONnpm · @swc/html · fixed in 1.15.47-nightly-20260729.1
- CVE-2026-72921SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling pathsGo · github.com/seaweedfs/seaweedfs · fixed in 0.0.0-20260512171048-05ed5c9ae8a2
- CVE-2026-72920SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative controlGo · github.com/seaweedfs/seaweedfs · fixed in 0.0.0-20260512171108-5e8f99f40a8a
- CVE-2026-46670YesWiki: Unauthenticated SQL InjectionPackagist · yeswiki/yeswiki · fixed in 4.6.4
- CVE-2026-72785Craft CMS before 5.10.6 Authorization Bypass via structures/move-elementPackagist · craftcms/cms · fixed in 5.10.6
- CVE-2026-72783Craft CMS 5.0.0-RC1 before 5.10.6 Path Traversal via ensurePathIsContainedPackagist · craftcms/cms · fixed in 5.10.6, 4.18.2
- CVE-2026-72782Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable LeakPackagist · craftcms/cms · fixed in 5.10.6, 4.18.2
- CVE-2026-72781Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox EscapePackagist · craftcms/cms · fixed in 5.10.7, 4.18.3