Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-118553AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-273Packagist · drupal/ai · fixed in 1.4.11, 1.5.2
- CVE-2026-118561Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274Packagist · drupal/single_content_sync · fixed in 1.4.19
- CVE-2026-118562Single Content Sync - Critical - Remote code execution - SA-CONTRIB-2026-275Packagist · drupal/single_content_sync · fixed in 1.4.19
- CVE-2026-118563CacheFlush - Critical - Unsupported - SA-CONTRIB-2026-276Packagist · drupal/cacheflush
- CVE-2026-118564PayUmoney for Drupal Commerce - Critical - Unsupported - SA-CONTRIB-2026-277Packagist · drupal/commerce_payumoney
- CVE-2026-118565GroupEx PRO ( Daxko ) integration - Critical - Unsupported - SA-CONTRIB-2026-278Packagist · drupal/groupexpro · fixed in 2.2.1
- CVE-2026-118582CAPTCHA - Moderately critical - Session Replay (CAPTCHA bypass) - SA-CONTRIB-2026-281Packagist · drupal/captcha · fixed in 1.18.0, 2.0.11
- CVE-2026-118569Fasttoggle - Moderately critical - Access bypass - SA-CONTRIB-2026-282Packagist · drupal/fasttoggle · fixed in 4.1.1
- CVE-2026-118570Fasttoggle - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-283Packagist · drupal/fasttoggle · fixed in 4.1.1
- CVE-2026-118574S3 File System - Moderately critical - Access bypass - SA-CONTRIB-2026-279Packagist · drupal/s3fs · fixed in 3.12.0
- CVE-2026-118567Bulk Update User Roles - Moderately critical - Incorrect authorization - SA-CONTRIB-2026-280Packagist · drupal/bulk_update_user_roles · fixed in 1.0.5
- CVE-2026-118572OAuth Login - OAuth OIDC SSO - Critical - Authentication bypass - SA-CONTRIB-2026-284Packagist · drupal/oauth_login_oauth2 · fixed in 3.1.1
- CVE-2026-118575Signature pad widget - Critical - Cross-site scripting - SA-CONTRIB-2026-285Packagist · drupal/sign_widget · fixed in 1.15.0
- CVE-2026-118576Stage File Proxy - Critical - Cross-site scripting - SA-CONTRIB-2026-286Packagist · drupal/stage_file_proxy · fixed in 3.1.7, 4.0.1
- CVE-2026-118554OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287Packagist · drupal/oidc · fixed in 2.3.1
- CVE-2026-118583Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-288Packagist · drupal/field_permissions · fixed in 1.6.0
- CVE-2026-118584Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-289Packagist · drupal/field_permissions · fixed in 1.6.0
- CVE-2026-118573OAuth2 Token Manager - Critical - Access bypass - SA-CONTRIB-2026-290Packagist · drupal/oauth2_token_manager · fixed in 1.2.0
- CVE-2026-118568Content Sync (content-sync.io) - Moderately critical - Information disclosure - SA-CONTRIB-2026-291Packagist · drupal/cms_content_sync · fixed in 3.2.2
- CVE-2026-118571Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-292Packagist · drupal/media_alias_display · fixed in 2.1.3, 3.0.3
- CVE-2026-119286GraphQL-core: Denial of service via memory leak in aborted validationsPyPI · graphql-core · fixed in 3.3.1
- CVE-2026-119285Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin readsGo · github.com/gofiber/fiber/v2 · fixed in 2.52.3
- CVE-2026-119284joserfc: Compact JWS size guard allocates attacker-controlled segments before rejectionPyPI · joserfc · fixed in 1.7.6
- CVE-2026-45049OpenAM Session Hijacking via CDSSOMaven · org.openidentityplatform.openam:openam-federation · fixed in 16.1.1
- CVE-2026-119283joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key DecryptionPyPI · joserfc · fixed in 1.7.5
- CVE-2026-119282Nx: OS command injection via nx.json plugin options in @nx/maven and @nx/gradlenpm · @nx/gradle, @nx/maven · fixed in 22.7.9, 23.1.2
- CVE-2026-119281MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticingMaven · org.mariadb.jdbc:mariadb-java-client · fixed in 3.3.7, 3.4.5, 3.5.11
- CVE-2026-119280MariaDB Connector/J : XA recover() trusted server-supplied gtrid and bqual lengthsMaven · org.mariadb.jdbc:mariadb-java-client · fixed in 3.3.7, 3.4.5, 3.5.11
- CVE-2026-119279MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengthsMaven · org.mariadb.jdbc:mariadb-java-client · fixed in 3.3.7, 3.4.5, 3.5.10
- CVE-2026-119276MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packetsMaven · org.mariadb.jdbc:mariadb-java-client · fixed in 3.3.7, 3.4.5, 3.5.11