Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-53516Better Auth: Account takeover via OAuth auto-link to unverified pre-registered emailnpm · better-auth · fixed in 1.6.11
- CVE-2026-58659PyTorch Lightning Arbitrary Code Execution via _instantiator HyperparameterPyPI · lightning, pytorch-lightning · fixed in 2.6.6
- CVE-2025-32781Apollo: Apollo Portal release endpoint allows cross-application configuration disclosure via releaseIdMaven · com.ctrip.framework.apollo:apollo
- CVE-2026-59954Apollo ConfigService access key authentication bypass via appId parsing and non-canonical matchingMaven · com.ctrip.framework.apollo:apollo
- CVE-2026-59955Apollo ConfigService access key authentication bypass via raw config file appId parsingMaven · com.ctrip.framework.apollo:apollo
- CVE-2026-45793Composer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logsPackagist · composer/composer · fixed in 2.9.8, 2.2.28, 1.10.28
- CVE-2026-49997SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deletedcrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-45804Diffusers: TOCTOU Trust Remote Code BypassPyPI · diffusers · fixed in 0.38.0
- CVE-2026-47703AdGuard Home: DoQ-to-UDP State Reduction and Source-Port OracleGo · github.com/adguardteam/adguardhome, github.com/adguardteam/dnsproxy · fixed in 0.107.75, 0.81.3
- CVE-2026-62685File Browser: Colliding username normalization gives two users the same home directoryGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.63.17
- CVE-2026-62843File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)Go · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.63.17
- CVE-2026-45805Penpot: MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCEnpm · @penpot/mcp · fixed in 2.15.0
- CVE-2026-54560Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claimGo · github.com/cloudreve/cloudreve, github.com/cloudreve/cloudreve/v3 +1 · fixed in 4.0.0-20260606015557-ed20843dc3df
- CVE-2026-54563Cloudreve: Path Traversal / Broken Access Control in Cloudreve WebDAV (`/dav`) — scoped DAV credential escapes its configured account rootGo · github.com/cloudreve/cloudreve, github.com/cloudreve/cloudreve/v3 +1 · fixed in 4.0.0-20260606032813-26b6b1044b02
- CVE-2026-54562Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responsesGo · github.com/cloudreve/cloudreve, github.com/cloudreve/cloudreve/v3 +1 · fixed in 4.0.0-20260606025411-aaebf317a78f
- CVE-2026-61836Directus: Authorization-dependent response served from unsegmented cache keynpm · directus · fixed in 12.0.0
- CVE-2026-61835Directus: SSRF Protection Bypass via 0.0.0.0 in File Importnpm · directus · fixed in 12.0.0
- CVE-2026-61740LightRAG: Authentication bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protectionPyPI · lightrag-hku · fixed in 1.5.4
- CVE-2026-61736LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed RequestsPyPI · lightrag-hku · fixed in 1.5.4
- CVE-2026-43637Cornac < 2.6.0 Path Traversal via _extract_archive() in download.pyPyPI · cornac · fixed in 2.6.0
- CVE-2026-61872ImageMagick before 7.1.2-26 Memory Leak via TIFF EncoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61871ImageMagick before 7.1.2-26 Memory Leak in ICON decoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61869ImageMagick before 7.1.2-26 Memory Leak in MIFF EncoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61868ImageMagick before 7.1.2-26 Memory Leak in YUV DecoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61867ImageMagick before 7.1.2-26 Memory Leak in TIFF EncoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61866ImageMagick before 7.1.2-26 Memory Leak in JNG encoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61865ImageMagick before 7.1.2-26 Memory Leak in Hough LinesNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61864ImageMagick before 7.1.2-26 Memory Leak in Log ColorspaceNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61863ImageMagick before 7.1.2-26 Memory Leak in TIFF EncoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61862ImageMagick before 7.1.2-26 Information Disclosure via identifyNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0