Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-69243AIOHTTP: HTTP request smuggling via WebSocket upgradePyPI · aiohttp · fixed in 3.14.2
- CVE-2026-69240Sequelize: SQL Injection (Oracle DB)npm · sequelize · fixed in 6.37.4
- CVE-2026-66065Ouroboros: Untrusted project .env can still reach RCE via omitted execution-routing keys (Incomplete fix of CVE-2026-47211)PyPI · ouroboros-ai · fixed in 0.42.1
- CVE-2026-47211Ouroboros: Remote Code Execution via Untrusted Project-Directory .envPyPI · ouroboros-ai · fixed in 0.39.0
- CVE-2026-69198ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checksnpm · ip-address · fixed in 10.2.2
- CVE-2026-69192ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypassnpm · ip-address · fixed in 10.3.1
- CVE-2026-18654Disabled SSH host key verification in Amazon AWS CLI EMR helper commandsPyPI · awscli · fixed in 1.45.28
- CVE-2026-69185Socket.IO: Zero-attachment Memory Exhaustionnpm · socket.io-parser · fixed in 4.2.7, 3.4.5, 3.3.6
- CVE-2026-48031Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token ForgeryGo · github.com/dhax/go-base · fixed in 0.0.0-20260517152733-cc82b9740fa6
- CVE-2026-69153PostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unsetnpm · postcss · fixed in 8.5.23
- CVE-2026-69152brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigationnpm · brace-expansion · fixed in 1.1.18, 2.1.4, 3.0.6 and more
- CVE-2026-69151Angular i18n: Cross-Site Scripting (XSS) via event-handler attributesnpm · @angular/compiler, @angular/core · fixed in 22.0.1, 21.2.19, 20.3.27
- CVE-2026-69149Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)npm · @angular/platform-server · fixed in 22.0.7, 21.2.19, 20.3.27
- CVE-2026-68945Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoningnpm · @angular/common · fixed in 22.0.2, 21.2.19, 20.3.27
- CVE-2026-68930Russh: Channel-scoped server callbacks can be reached without an open channelcrates.io · russh · fixed in 0.62.5
- CVE-2026-69097GitPython before 3.1.53 Config Injection via Submodule NamesPyPI · gitpython · fixed in 3.1.53
- CVE-2026-69089Grav CMS before 2.0.11 Path Traversal via watermarkPackagist · getgrav/grav · fixed in 2.0.11
- CVE-2026-69088Grav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation via BlueprintPackagist · getgrav/grav · fixed in 2.0.11
- CVE-2026-69086SiYuan before v3.7.3 Path Traversal via unvalidated avIDGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260720151813-0f5a0e7c67b0
- CVE-2026-69085SiYuan before v3.7.3 SQL Injection via searchDocsGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260721043339-eef10568384e
- CVE-2026-69084SiYuan before v3.7.3 SQL Injection via searchEmbedBlockGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260721002947-23a17d44b5f3
- CVE-2026-69083SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContentGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260721004815-cf42dd5680c8
- CVE-2026-68587SiYuan before v3.7.3 Information Disclosure via getHeading*TransactionGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260721013353-69db783b782a
- CVE-2026-68586SiYuan before v3.7.3 Content Disclosure via getBacklinkDocGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260721014413-f45749a7ef6e
- CVE-2026-68585SiYuan before v3.7.3 Metadata Disclosure via getBlockInfoGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260721014951-ffde3b21eca4
- CVE-2026-68584SiYuan before v3.7.3 Authentication Bypass via Content EndpointsGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260721020826-2d069dce84a2
- CVE-2026-12259Improper Input Validation in nltk/nltkPyPI · nltk · fixed in 3.9.3
- CVE-2026-13506Lazy ASN.1 sequence forcing resets nesting-depth guardMaven · org.bouncycastle:bc-fips, org.bouncycastle:bcprov-jdk15to18 +2 · fixed in 1.0.2.7, 2.0.2, 2.1.3 and more
- CVE-2026-8763Name Constraints bypass via trailing dot in rfc822Name and URIMaven · org.bouncycastle:bc-fips, org.bouncycastle:bcprov-jdk15to18 +2 · fixed in 1.0.2.7, 2.0.2, 2.1.3 and more
- CVE-2026-9856Path Traversal in huggingface/transformersPyPI · transformers · fixed in 5.10.0