Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-68582Vikunja 0.24.0 Broken Object Level Authorization via Link-Share TokenGo · code.vikunja.io/api · fixed in 2.4.0
- CVE-2026-68581Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID CollisionGo · code.vikunja.io/api · fixed in 2.4.0
- CVE-2025-71401better-auth before 1.4.2 basePath Modification DoSnpm · better-auth · fixed in 1.4.2
- CVE-2025-71400better-auth passkey before 1.4.0 IDOR via delete-passkeynpm · @better-auth/passkey · fixed in 1.4.0
- CVE-2025-71399Better Auth before 1.4.5 Path Normalization Bypass via rou3npm · better-auth · fixed in 1.4.5
- CVE-2026-9335Improper Handling of HDF5 ExternalLinks in keras-team/kerasPyPI · keras · fixed in 3.12.3, 3.15.0
- CVE-2026-67354guzzlehttp/guzzle before 7.15.1 URI Fragment Disclosure via RefererPackagist · guzzlehttp/guzzle · fixed in 7.15.1
- CVE-2026-67336better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvidernpm · better-auth · fixed in 1.6.11
- CVE-2026-67309Traefik v3.7.0 Path Traversal via RewriteTarget Authentication BypassGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 3.7.8
- CVE-2026-67326GitPython before 3.1.50 Newline Injection via config_writer sectionPyPI · gitpython · fixed in 3.1.50
- CVE-2026-67340ArcadeDB before 26.7.2 Remote Code Execution via Trigger ScriptsMaven · com.arcadedb:arcadedb-engine · fixed in 26.7.2
- CVE-2026-67321axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypassnpm · axios · fixed in 0.33.0, 1.18.0
- CVE-2026-67333better-auth before 1.6.13 Stored XSS via javascript redirect_urinpm · better-auth · fixed in 1.6.13, 1.7.0-beta.4
- CVE-2026-67319axios before 0.33.0 Prototype Pollution via nested option objectsnpm · axios · fixed in 0.33.0, 1.18.0
- CVE-2026-67324GitPython 3.1.50 Authentication Bypass via Joined Short OptionsPyPI · gitpython · fixed in 3.1.51
- CVE-2026-67329@better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscriptionnpm · @better-auth/stripe · fixed in 1.6.21, 1.7.0-beta.10
- CVE-2026-67323GitPython before 3.1.51 Command Injection via unguarded Git optionsPyPI · gitpython · fixed in 3.1.51
- CVE-2026-67318axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2npm · axios · fixed in 1.18.0
- CVE-2026-67316axios before 1.18.0 Prototype Pollution via bodyless methodsnpm · axios · fixed in 1.18.0, 0.33.0
- CVE-2026-67334better-auth Stale Sessions Persist After User Deletionnpm · @better-auth/scim, better-auth · fixed in 1.6.11
- CVE-2026-67315axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0npm · axios · fixed in 1.18.0, 0.33.0
- CVE-2025-71403better-auth before 1.1.20 Open Redirect via trustedOrigins Bypassnpm · better-auth · fixed in 1.1.21
- CVE-2026-67312axios 0.28.0 before 0.33.0 and 1.0.0 before 1.18.0 Denial of Service via formToJSONnpm · axios · fixed in 0.33.0, 1.18.0
- CVE-2026-67341ArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTIONMaven · com.arcadedb:arcadedb-engine · fixed in 26.7.2
- CVE-2026-67332@better-auth/oauth-provider before 1.7.0-beta.4 Authorization Bypassnpm · @better-auth/oauth-provider · fixed in 1.7.0-beta.4
- CVE-2026-67337better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCachenpm · better-auth · fixed in 1.4.9
- CVE-2025-71404better-auth before 1.1.16 Reflected XSS via error parameternpm · better-auth · fixed in 1.1.16
- CVE-2026-67327better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTPnpm · better-auth · fixed in 1.6.22, 1.7.0-beta.10
- CVE-2026-67355guzzlehttp/guzzle before 7.15.1 Host-only Cookie ScopePackagist · guzzlehttp/guzzle · fixed in 7.15.1
- CVE-2026-67331better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypassnpm · @better-auth/scim · fixed in 1.7.0-beta.4