Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-67320axios before 0.33.0 Prototype Pollution via Node HTTP adapternpm · axios · fixed in 0.33.0, 1.18.0
- CVE-2026-67338JupyterLab before 4.5.9 Stored XSS via Extension ManagerPyPI · jupyterlab · fixed in 4.5.9
- CVE-2026-67353guzzlehttp/guzzle before 7.15.1 Unbounded Cookie Denial of ServicePackagist · guzzlehttp/guzzle · fixed in 7.15.1
- CVE-2026-67335better-auth before 1.6.2 OAuth State Validation Bypassnpm · better-auth · fixed in 1.6.2
- CVE-2026-67339guzzlehttp/guzzle before 7.14.2 Proxy-Authorization Header DisclosurePackagist · guzzlehttp/guzzle · fixed in 7.14.2
- CVE-2026-67322GitPython before 3.1.52 Environment Variable Exfiltration via clone_fromPyPI · gitpython · fixed in 3.1.52
- CVE-2026-67325GitPython before 3.1.51 Command Injection via option prefix abbreviationPyPI · gitpython · fixed in 3.1.51
- CVE-2026-67330better-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collisionnpm · @better-auth/scim · fixed in 1.6.22, 1.7.0-beta.10
- CVE-2026-67342ArcadeDB before 26.7.2 Authorization Bypass via Database HandlersMaven · com.arcadedb:arcadedb-server · fixed in 26.7.2
- CVE-2026-67317axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStreamnpm · axios · fixed in 1.18.0
- CVE-2025-71402better-auth before 1.4.0 Session Revocation via Forged Cookienpm · better-auth · fixed in 1.4.0
- CVE-2026-67314axios before 1.18.0 Prototype Pollution via auth subfieldsnpm · axios · fixed in 1.18.0
- CVE-2026-67313axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSONnpm · axios · fixed in 0.33.0, 1.18.0
- CVE-2026-45377Decidim: Private exports can be downloaded through reusable linksRubyGems · decidim-core · fixed in 0.30.9, 0.31.5, 0.32.0
- CVE-2026-45376Decidim: Admin user search allows SQL injection through similarity-based sortingRubyGems · decidim-admin · fixed in 0.30.9, 0.31.5, 0.32.0
- CVE-2026-54785gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline modePyPI · gemini-bridge · fixed in 1.3.1
- CVE-2026-54768WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)Packagist · wp-graphql/wp-graphql
- CVE-2026-53573core-geonetwork has an Open Redirect BypassMaven · org.geonetwork-opensource:geonetwork · fixed in 4.2.16, 4.4.11
- CVE-2026-45330Decidim: Verification admins can access supplied IDs from other organisationsRubyGems · decidim-verifications · fixed in 0.30.9, 0.31.5, 0.32.0
- CVE-2026-54909Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attributeGo · github.com/pion/stun, github.com/pion/stun/v2 +1 · fixed in 3.1.5
- CVE-2026-54787sigstore-go fails to check signature timestamps against a signing key's validity periodGo · github.com/sigstore/sigstore-go · fixed in 1.2.1
- CVE-2026-45086Decidim: Forms admin question editor lacks authorizationRubyGems · decidim-demographics · fixed in 0.31.5, 0.32.0
- CVE-2026-68770sentence-transformers Arbitrary Code Execution on Local Model Load Despite trust_remote_code=FalsePyPI · sentence-transformers · fixed in 5.6.0
- CVE-2026-53551free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failureGo · github.com/free5gc/ausf, github.com/free5gc/free5gc · fixed in 1.4.5, 4.2.2, 4.2.2+incompatible
- CVE-2026-53599Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlersPackagist · redaxo/source · fixed in 5.21.1
- CVE-2026-53510Savon::Model evaluates WSDL operation names as Ruby sourceRubyGems · savon · fixed in 2.17.2
- CVE-2026-65841Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitizationnpm · jodit · fixed in 4.13.6
- CVE-2026-62324Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSSnpm · jodit · fixed in 4.12.31
- CVE-2026-55825Contao: Possible path traversal in job download URIsPackagist · contao/contao, contao/core-bundle · fixed in 5.7.7
- CVE-2026-55824Contao crawler leaks auth credentials to external hostsPackagist · contao/contao, contao/core-bundle · fixed in 5.3.47, 5.7.7