Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-55548Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packetsMaven · org.yamcs:yamcs-core · fixed in 5.13.2, 5.12.8
- CVE-2026-46621Yamcs: Authenticated Remote Code Execution (RCE) via Jython Algorithm Code InjectionMaven · org.yamcs:yamcs-core · fixed in 5.12.7
- CVE-2026-46562Yamcs: Remote Code Execution via Mission Database algorithm overrideMaven · org.yamcs:yamcs-core · fixed in 5.12.7
- CVE-2026-44632Yamcs: Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory`Maven · org.yamcs:yamcs-core · fixed in 5.12.7
- CVE-2026-44596Yamcs: No Rate Limiting on Authentication EndpointMaven · org.yamcs:yamcs-core · fixed in 5.12.7
- CVE-2026-44595Yamcs: Unauthorized user enumeration via IAM API endpointsMaven · org.yamcs:yamcs-core · fixed in 5.12.7
- CVE-2026-55407Buffa: Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocationcrates.io · buffa · fixed in 0.8.0
- CVE-2026-55406Buffa: Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Derefcrates.io · buffa · fixed in 0.7.0
- CVE-2026-45695Kopia: Unauthenticated RCE via SSH ProxyCommand Injection when --insecure --without-password is usedGo · github.com/kopia/kopia · fixed in 0.23.0
- CVE-2026-53598Prompty: Arbitrary File Read via ${file:path} Reference Expansionnpm · @prompty/core · fixed in 2.0.0-beta.2
- CVE-2026-53597Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loadernpm · @prompty/core · fixed in 2.0.0-beta.3
- CVE-2026-59867Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $refNuGet · microsoft.openapi.kiota, microsoft.openapi.kiota.builder · fixed in 1.32.5, 1.29.1
- CVE-2026-59866Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceNameNuGet · microsoft.openapi.kiota, microsoft.openapi.kiota.builder · fixed in 1.32.5, 1.29.1
- CVE-2026-59864Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensionsNuGet · microsoft.openapi.kiota, microsoft.openapi.kiota.builder · fixed in 1.32.5, 1.29.1
- CVE-2026-59865Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`NuGet · microsoft.openapi.kiota, microsoft.openapi.kiota.builder · fixed in 1.32.5, 1.29.1
- CVE-2026-59863Kiota: Workspace-config poisoning: out-of-repo file write + generation-time SSRFNuGet · microsoft.openapi.kiota, microsoft.openapi.kiota.builder · fixed in 1.32.5, 1.29.1
- CVE-2026-59859Kiota: Code Generation Literal Injection in the PHP GeneratorNuGet · microsoft.openapi.kiota, microsoft.openapi.kiota.builder · fixed in 1.32.4, 1.29.1
- CVE-2026-59862Kiota: Code Generation Literal Injection in the Python GeneratorNuGet · microsoft.openapi.kiota, microsoft.openapi.kiota.builder · fixed in 1.32.0, 1.29.1
- CVE-2026-59861Kiota: Code Generation Literal Injection in Kiota Ruby GeneratorNuGet · microsoft.openapi.kiota, microsoft.openapi.kiota.builder · fixed in 1.32.0, 1.29.1
- CVE-2026-59860Kiota: XML Doc-Comment Newline Breakout Code InjectionNuGet · microsoft.openapi.kiota, microsoft.openapi.kiota.builder · fixed in 1.32.3, 1.29.1
- CVE-2026-15925Improper TLS Hostname Verification in Snowflake Connector for PythonPyPI · snowflake-connector-python · fixed in 3.18.1, 4.7.1
- GHSA-62GX-5Q78-WRVXobsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/write/deletenpm · obsidian-local-rest-api · fixed in 4.1.3
- CVE-2026-54458AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket PluginPackagist · wwbn/avideo · fixed in 29.1.0
- CVE-2026-48795Incomplete fix for CVE-2026-25754 in @adonisjs/bodyparsernpm · @adonisjs/bodyparser · fixed in 10.1.5, 11.0.3
- CVE-2026-55445Qinglong: Incomplete fix for CVE-2026-3965: Improper Authenticationnpm · @whyour/qinglong · fixed in 2.20.1
- CVE-2026-62314Anubis: Policy bypass via client controlled X-Original-URI headerGo · github.com/techarohq/anubis · fixed in 1.26.0
- CVE-2026-50183WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery SectionPackagist · wwbn/avideo
- CVE-2026-50182AVideo Has Unauthenticated Reflected XSS via $_GET['search'] in YouTubeAPI Gallery PaginationPackagist · wwbn/avideo
- CVE-2026-49279WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)Packagist · wwbn/avideo
- CVE-2026-62361listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentialsGo · github.com/knadh/listmonk · fixed in 1.1.1-0.20260619102436-c0a6525009a6