Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-62323Cloudreve: Unauthorized file write via WOPI view sessions whose access token secret is ignoredGo · github.com/cloudreve/cloudreve, github.com/cloudreve/cloudreve/v3 +1 · fixed in 4.0.0-20260626022433-f3347130ac48
- CVE-2026-55502Cloudreve: OAuth Admin.Read scope can update OneDrive storage policy credentialsGo · github.com/cloudreve/cloudreve, github.com/cloudreve/cloudreve/v3 +1 · fixed in 4.17.0
- CVE-2026-55499Cloudreve: Broken access control in file event stream leaks activity events for unshared siblings to single-file share recipientsGo · github.com/cloudreve/cloudreve, github.com/cloudreve/cloudreve/v3 +1 · fixed in 4.0.0-20260613030215-0b00dd308f13
- CVE-2026-55497Cloudreve: Server crash through image decompression/pixel bomb in thumbnail & avatar decoding (DoS)Go · github.com/cloudreve/cloudreve, github.com/cloudreve/cloudreve/v3 +1 · fixed in 4.0.0-20260613024411-3607f79bb44c
- CVE-2026-55496Cloudreve: Inactive/banned account emails leaked via GET /api/v4/user/search because SearchActive() omits the active-status predicateGo · github.com/cloudreve/cloudreve, github.com/cloudreve/cloudreve/v3 +1 · fixed in 4.0.0-20260613023921-7e1289d55279
- CVE-2026-55495Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner AccountGo · github.com/cloudreve/cloudreve, github.com/cloudreve/cloudreve/v3 +1 · fixed in 4.0.0-20260613023150-7968e50429ef
- CVE-2026-68501Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PIIPackagist · sylius/mollie-plugin · fixed in 2.2.8, 3.2.4, 3.3.1
- CVE-2026-68500Sylius Mollie Plugin: Payment status forgery via the payment webhookPackagist · sylius/mollie-plugin · fixed in 2.2.8, 3.2.4, 3.3.1
- CVE-2026-68499re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)npm · re2 · fixed in 1.25.2
- CVE-2026-67550re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS)npm · re2 · fixed in 1.25.2
- CVE-2026-65835Capsule: Incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation)Go · github.com/projectcapsule/capsule · fixed in 0.13.8
- CVE-2026-65834Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requestsGo · github.com/projectcapsule/capsule · fixed in 0.13.8
- CVE-2026-18140Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated serverscrates.io · aws-smithy-json · fixed in 0.62.7
- CVE-2026-66066Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processingRubyGems · activestorage · fixed in 7.2.3.2, 8.0.5.1, 8.1.3.1
- CVE-2026-59881AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflatePyPI · aiohttp · fixed in 3.14.2
- CVE-2026-61536Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCEPyPI · banks · fixed in 2.4.3
- CVE-2026-54522MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer DisclosureRubyGems · msgpack · fixed in 1.8.2
- CVE-2026-54722dssrf: there a critical security bug with remove_at_symbol_in_stringnpm · dssrf · fixed in 1.0.4
- CVE-2026-59952Valibot: record() issue paths can make flatten() throw for inherited Object property namesnpm · valibot · fixed in 1.4.2
- CVE-2026-62946ImageMagick: Integer Overflow in JNX decoder causes heap buffer over-write when processing extremly large files on 32-bit buildsNuGet · magick.net-q16-anycpu, magick.net-q16-hdri-anycpu +4 · fixed in 14.15.0
- CVE-2026-62363ImageMagick: Heap Buffer Over-Write in fx operationNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-62343ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is providedNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-15157undici vulnerable to CRLF Injection via blob-like body 'type' propertynpm · undici · fixed in 6.28.0, 7.29.0, 8.9.0
- CVE-2026-14643undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directivesnpm · undici · fixed in 7.29.0, 8.9.0
- CVE-2026-16728undici vulnerable to downstream response desynchronization via retry interceptornpm · undici · fixed in 6.28.0, 7.29.0, 8.9.0
- CVE-2026-67439OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action OutputGo · github.com/olivetin/olivetin · fixed in 0.0.0-20260708085316-e421780c9885
- CVE-2026-67438OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety CheckGo · github.com/olivetin/olivetin · fixed in 0.0.0-20260708084548-995ff79736f2
- CVE-2026-67437OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)Go · github.com/olivetin/olivetin · fixed in 0.0.0-20260708075951-ec114e95d297
- CVE-2026-54249VercelAIAdapter trusts client-controlled `providerMetadata` to construct `UploadedFile` — S3/GCS confused deputy via provider metadata injectionPyPI · pydantic-ai, pydantic-ai-slim · fixed in 1.106.0, 2.0.0b6
- CVE-2026-46678Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)PyPI · pydantic-ai, pydantic-ai-slim · fixed in 1.99.0