Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-45414Decidim: JWT-backed authentication can be replayed across organizationsRubyGems · decidim · fixed in 0.31.5, 0.32.0
- CVE-2026-71433LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite storesPyPI · langgraph-checkpoint-postgres, langgraph-checkpoint-sqlite · fixed in 3.1.1
- CVE-2026-64655GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN MatchingGo · github.com/cli/cli, github.com/cli/cli/v2 · fixed in 2.97.0
- CVE-2026-64653GitHub CLI: Unescaped variable components in request URLs could allow path traversalGo · github.com/cli/cli, github.com/cli/cli/v2 · fixed in 2.97.0
- CVE-2026-64652GitHub CLI: Partial token disclosure in `gh auth status` outputGo · github.com/cli/cli, github.com/cli/cli/v2 · fixed in 2.97.0
- CVE-2026-71327Traefik: Gateway API route identity collision allows cross-namespace backend hijackingGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 3.6.25, 3.7.10
- CVE-2026-71326Traefik: BasicAuth singleflight key collision allows authenticated identity spoofingGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 3.6.25, 3.7.10
- CVE-2026-71325Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRefGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.54, 3.6.25, 3.7.10
- CVE-2026-71324Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive poolGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.53, 3.6.24, 3.7.9
- CVE-2026-70646aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handlerPyPI · aiosend · fixed in 3.0.7
- CVE-2026-64640Apache Polaris: register endpoint reads attacker-controlled storage location before allowed-locations validationPyPI · apache-polaris · fixed in 1.7.0
- CVE-2026-71321Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validationnpm · nuxt · fixed in 4.5.1, 3.21.10
- CVE-2026-71320Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Propsnpm · nuxt · fixed in 4.5.1, 3.21.10
- CVE-2026-71319Nuxt.js Unauthenticated WebSocket RPC Call Leading to Remote Code Executionnpm · @nuxt/devtools · fixed in 3.3.1
- CVE-2026-71318Nuxt: Unauthorized Component Instantiation via Server Island Propsnpm · nuxt · fixed in 4.5.1, 3.21.10
- CVE-2026-71316Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clientsnpm · nuxt · fixed in 4.5.1
- CVE-2026-71315Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)npm · nuxt · fixed in 4.5.1, 3.21.10
- CVE-2026-71314Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island renderingnpm · nuxt · fixed in 4.5.1, 3.21.10
- CVE-2026-71313rclone: Local Encoding Path TraversalGo · github.com/rclone/rclone · fixed in 1.75.0
- CVE-2026-71312rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command ExecutionGo · github.com/rclone/rclone · fixed in 1.75.0
- CVE-2026-71311rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves NewlinesGo · github.com/rclone/rclone · fixed in 1.75.0
- CVE-2026-34966Gitea prior to 1.27.0 SSRF via Migration URI Fetch BypassGo · code.gitea.io/gitea, gitea.dev · fixed in 1.27.0
- CVE-2026-71310rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone MemoryGo · github.com/rclone/rclone · fixed in 1.75.0
- CVE-2026-71309rclone: Incomplete path validation allows backend root escape in serve resticGo · github.com/rclone/rclone · fixed in 1.75.0
- CVE-2026-55524PraisonAI: SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap)PyPI · praisonaiagents · fixed in 1.6.58
- CVE-2026-66885Livebook Teams identity callback lacks state binding, allowing login CSRFHex · livebook · fixed in 0.18.7, 0.19.9
- CVE-2026-66298JS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcutsHex · livebook · fixed in 0.18.7, 0.19.9
- CVE-2026-66297Unescaped deployment environment variables in generated setup commandsHex · livebook · fixed in 0.18.7, 0.19.9
- CVE-2026-66881Path traversal in imported file_entries name allows arbitrary file write via URL-type entry downloadHex · livebook · fixed in 0.18.7, 0.19.9
- CVE-2026-68746Livebook Teams identity check fails open when the deployment group is unresolvable, allowing unauthenticated accessHex · livebook · fixed in 0.19.9