Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-53551free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failureGo · github.com/free5gc/ausf, github.com/free5gc/free5gc · fixed in 1.4.5, 4.2.2, 4.2.2+incompatible
- CVE-2026-53599Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlersPackagist · redaxo/source · fixed in 5.21.1
- CVE-2026-53510Savon::Model evaluates WSDL operation names as Ruby sourceRubyGems · savon · fixed in 2.17.2
- CVE-2026-65841Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitizationnpm · jodit · fixed in 4.13.6
- CVE-2026-62324Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSSnpm · jodit · fixed in 4.12.31
- CVE-2026-55825Contao: Possible path traversal in job download URIsPackagist · contao/contao, contao/core-bundle · fixed in 5.7.7
- CVE-2026-55824Contao crawler leaks auth credentials to external hostsPackagist · contao/contao, contao/core-bundle · fixed in 5.3.47, 5.7.7
- CVE-2026-53502Thumbor has path traversal via post-validation URL decoding bypass in file_loaderPyPI · thumbor · fixed in 7.8.0
- CVE-2026-53505Thumbor proportion filter allows unbounded post-transform resize leading to remote DoSPyPI · thumbor · fixed in 7.8.0
- CVE-2026-53504Thumbor has Regex Denial of Service (ReDoS) in `convolution` filterPyPI · thumbor · fixed in 7.8.0
- CVE-2026-53503Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoSPyPI · thumbor · fixed in 7.8.0
- CVE-2026-53501Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signaturePyPI · thumbor · fixed in 7.8.0
- CVE-2026-53500Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dotPyPI · thumbor · fixed in 7.8.0
- CVE-2026-57232Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader ModulePackagist · contao/contao, contao/core-bundle · fixed in 5.3.48, 5.7.9
- CVE-2026-54737@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Mergingnpm · @phun-ky/defaults-deep · fixed in 2.0.5
- CVE-2026-54725vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest APIGo · github.com/bank-vaults/vault-secrets-webhook · fixed in 1.23.1
- CVE-2026-55100hashi-vault-js has a path traversal and query parameter injectionnpm · hashi-vault-js · fixed in 0.5.2
- CVE-2026-54729dssrf: any users using 1.1.1.1 DNS is impacted by SSRFnpm · dssrf · fixed in 1.0.5
- CVE-2026-54706OnionShare follows symlinks in shared directories, allowing unintended disclosure of local filesPyPI · onionshare-cli · fixed in 2.6.4
- CVE-2026-54707OnionShare Receive mode writes uploaded files even when file uploads are disabledPyPI · onionshare-cli · fixed in 2.6.4
- CVE-2026-52856Wings: Maliciously crafted packet during SFTP connection handshake causes denial of serviceGo · github.com/pterodactyl/wings · fixed in 1.13.0
- CVE-2026-52855Wings exposes node configuration secrets through egg configuration-file templatingGo · github.com/pterodactyl/wings · fixed in 1.12.3
- CVE-2026-52857Wings: Maliciously or erroneously created parsed config files can cause wings process to OOMGo · github.com/pterodactyl/wings · fixed in 1.13.0
- GHSA-P7W7-4929-VPJ5`@dynatrace-oss/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool Invocationnpm · @dynatrace-oss/dynatrace-mcp-server · fixed in 2.0.0
- CVE-2026-18446fast-uri vulnerable to host confusion via backslash authority introducernpm · fast-uri · fixed in 2.4.4, 3.1.5, 4.1.2
- CVE-2026-64607Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoSMaven · org.apache.httpcomponents.client5:httpclient5 · fixed in 5.6.3
- CVE-2026-63223CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rulesPackagist · codeigniter4/framework · fixed in 4.7.4
- CVE-2026-63222CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenamesPackagist · codeigniter4/framework · fixed in 4.7.4
- CVE-2026-63221CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditionsPackagist · codeigniter4/framework · fixed in 4.7.4
- CVE-2026-63220CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()Packagist · codeigniter4/framework · fixed in 4.7.4