Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-54685FileBrowser Quantum has Username Enumeration via Authentication Timing Side-ChannelGo · github.com/gtsteffaniak/filebrowser/backend · fixed in 0.0.0-20260317230626-af08800667b8
- CVE-2026-46410FileBrowser Quantum: unauthenticated user share share infoGo · github.com/gtsteffaniak/filebrowser, github.com/gtsteffaniak/filebrowser/backend · fixed in 1.2.1-stable.0.20260514154726-1802e1281135, 0.0.0-20260514154726-1802e1281135
- CVE-2026-45270CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation RulePackagist · ci4-cms-erp/ci4ms · fixed in 0.31.9.0
- CVE-2026-45139CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operationsPackagist · ci4-cms-erp/ci4ms · fixed in 0.31.9.0
- CVE-2026-63763SurrealDB before 2.5.0 Privilege Escalation via Future Fieldscrates.io · surrealdb · fixed in 2.5.0, 3.0.0-beta.3
- CVE-2026-63762SurrealDB before v2.6.1 Denial of Service via scriptingcrates.io · surrealdb · fixed in 2.6.1, 3.0.0-beta.3
- CVE-2026-63761SurrealDB before 3.1.0 Algorithm Downgrade via ES512crates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63760SurrealDB before 3.1.0 Denial of Service via JSON Parsercrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63759SurrealDB before 3.1.0 Denial of Service nested type annotationscrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63758SurrealDB before 3.1.0 Authorization Bypass via KILL Statementcrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63757SurrealDB before 3.1.0 Session Hijacking via /rpc sessionscrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63756SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Conditioncrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63755SurrealDB before 3.1.0 Permission Bypass via WHERE Clausecrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63754SurrealDB before 3.1.0 Denial of Service via LIVE Querycrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63753SurrealDB before 3.1.0 Authentication Bypass via LIVE Querycrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63752SurrealDB before 3.1.0 RELATE Statement Record Overwritecrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63751SurrealDB before 3.1.0 Field Permission Bypass via JSON Patchcrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63750SurrealDB before 3.1.0 Memory Amplification via /sql WebSocketcrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63749SurrealDB before 3.1.0 Authentication Bypass via LIVE SELECTcrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63748SurrealDB before 3.1.0 Information Disclosure via Error Messagescrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63747SurrealDB before 3.1.0 Denial of Service via malformed RPC usecrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63746SurrealDB before 3.1.0 Permission Bypass via Graph Traversalcrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63745SurrealDB before 3.1.0 Authorization Bypass via Composite Record-idcrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63744SurrealDB before 3.1.5 SSRF via JWKS URL Redirectcrates.io · surrealdb · fixed in 3.1.5
- CVE-2026-63743SurrealDB before 3.1.0 Port-Specific Deny Rule Bypass via HTTP Redirectcrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63742SurrealDB before 3.1.0 Field Permission Bypass via Indexed COUNTcrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63741SurrealDB before 3.1.0 Authentication Bypass via USE statementcrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63740SurrealDB before 3.1.4 Array Element Permission Bypasscrates.io · surrealdb · fixed in 3.1.4
- CVE-2026-63739SurrealDB before 3.1.5 Arbitrary File Read via DEFINE ANALYZERcrates.io · surrealdb · fixed in 3.1.5
- CVE-2026-63738SurrealDB 3.1.0 before 3.1.5 Field Permission Bypass via Traversalcrates.io · surrealdb · fixed in 3.1.5