Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-55523PraisonAI has a`web_crawl` SSRF protection bypass via unchecked redirect targetsPyPI · praisonaiagents · fixed in 1.6.58
- CVE-2026-55522PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe codePyPI · praisonai, praisonaiagents · fixed in 4.6.58, 1.6.58
- CVE-2026-9205Langflow is affected by weaknesses in secret handling and sensitive configuration accessPyPI · langflow · fixed in 1.10.1
- CVE-2026-70612Electron: Sandboxed iframes can launch external protocol handlersnpm · electron · fixed in 39.8.8, 40.9.0, 41.2.1 and more
- CVE-2026-70611Electron: DevTools embedder handler executes arbitrary files via shell opennpm · electron · fixed in 39.8.9, 40.9.2, 41.2.1 and more
- CVE-2026-70610Electron: contextBridge object copy honors prototype settersnpm · electron · fixed in 39.8.9, 40.9.2, 41.2.2 and more
- CVE-2026-70609Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameternpm · electron · fixed in 39.8.7, 40.9.0, 41.2.0 and more
- CVE-2026-70608Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation pathnpm · electron · fixed in 42.0.1, 41.10.3, 39.8.10
- CVE-2026-70607Electron: window.open features string controls some window options considered privilegednpm · electron · fixed in 39.8.8, 40.9.0, 41.2.1 and more
- CVE-2026-70606Electron: ProtocolResponse.url reuses the default session cache instead of the registering sessionnpm · electron · fixed in 43.0.0, 42.5.1, 41.9.1 and more
- CVE-2026-70605Electron: HTTP redirect followed into local file loadernpm · electron · fixed in 39.8.8, 40.9.1, 41.2.1 and more
- CVE-2026-70604Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin readsnpm · electron · fixed in 42.0.0, 41.4.0, 40.9.3 and more
- CVE-2026-70603Electron: shell.openPath path validation bypass via embedded null bytenpm · electron · fixed in 42.0.0-beta.1, 41.1.1, 40.9.0 and more
- CVE-2026-70602Electron: Extension tab APIs operate across session boundariesnpm · electron · fixed in 39.8.8, 40.9.0, 41.2.1 and more
- CVE-2026-70601Electron: Context isolation bypass via Function.prototype.bind hijacknpm · electron · fixed in 39.8.9, 40.9.2, 41.2.2 and more
- CVE-2026-70600Electron: Cross-origin iframe can position native autofill popupnpm · electron · fixed in 39.8.8, 40.9.1, 41.2.1 and more
- CVE-2026-70599Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Originnpm · electron · fixed in 39.8.7, 40.9.0, 41.2.0 and more
- CVE-2026-70598Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory sizenpm · electron · fixed in 39.8.10, 40.9.0, 41.2.1 and more
- CVE-2026-70597Electron: Parent process code-sign check is spoofablenpm · electron · fixed in 39.8.8, 40.9.1, 41.2.1 and more
- CVE-2026-70596Ghost: Cross-Site Scripting in Feature Image Captionsnpm · ghost · fixed in 6.54.1
- CVE-2026-70595Ghost: Server-Side Request Forgery Mitigation Issuenpm · ghost · fixed in 6.54.1
- CVE-2026-71293Statamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current_user VariablePackagist · statamic/cms
- CVE-2026-71211mlflow - Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy EndpointPyPI · mlflow
- CVE-2026-66274Apache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflowMaven · org.apache.qpid:proton-j · fixed in 0.35.0
- CVE-2026-70594Ghost: Session Fixation in Ghost Adminnpm · ghost · fixed in 6.54.1
- CVE-2026-70593Ghost: Theme Upload Path Traversalnpm · ghost · fixed in 6.54.1
- CVE-2026-70592Ghost: Database Backup Path Traversalnpm · ghost · fixed in 6.54.1
- CVE-2026-70591Ghost: Server-Side Request Forgery in Image Fetchingnpm · ghost · fixed in 6.54.1
- CVE-2026-70590Ghost: Blind Password Hash Disclosure in Ghost Admin APInpm · ghost · fixed in 6.54.1
- CVE-2026-70589Ghost: Archived Offers can be Redeemednpm · ghost · fixed in 6.54.1