Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-61867ImageMagick before 7.1.2-26 Memory Leak in TIFF EncoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61866ImageMagick before 7.1.2-26 Memory Leak in JNG encoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61865ImageMagick before 7.1.2-26 Memory Leak in Hough LinesNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61864ImageMagick before 7.1.2-26 Memory Leak in Log ColorspaceNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61863ImageMagick before 7.1.2-26 Memory Leak in TIFF EncoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61862ImageMagick before 7.1.2-26 Information Disclosure via identifyNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61860ImageMagick before 7.1.2-26 Use-After-Free via freetypeNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61859ImageMagick before 7.1.2-26 Policy Bypass via script operationNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61464ImageMagick before 7.1.2-26 Heap Buffer Over-Write via X11NuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61453Grav before 2.0.1 XSS via Twig String ConcatenationPackagist · getgrav/grav · fixed in 2.0.1
- CVE-2026-61449Grav before 2.0.2 Decompression Bomb via Forged ZIP SizePackagist · getgrav/grav · fixed in 2.0.2
- CVE-2026-61446PraisonAI before 1.6.78 Remote Code Execution via Plugin Auto-DiscoveryPyPI · praisonaiagents · fixed in 1.6.78
- CVE-2026-61443PraisonAI before 1.6.78 Remote Code Execution via SkillToolsPyPI · praisonaiagents · fixed in 1.6.78
- CVE-2026-61440PraisonAI Platform before 0.1.9 Authorization Bypass via Label EndpointsPyPI · praisonai-platform · fixed in 0.1.9
- CVE-2026-61436PraisonAI before 4.6.78 Missing Webhook Signature VerificationPyPI · praisonai · fixed in 4.6.78
- CVE-2026-61435PraisonAI before 4.6.78 Authentication Bypass via Host Header SpoofingPyPI · praisonai · fixed in 4.6.78
- CVE-2026-61433PraisonAI before 4.6.78 Code Injection via API deployment generatorPyPI · praisonai · fixed in 4.6.78
- CVE-2026-61430PraisonAI before 1.6.78 DNS Rebinding SSRF via web_crawlPyPI · praisonaiagents · fixed in 1.6.78
- CVE-2026-61427PraisonAI before 4.6.78 Authentication Bypass via HTTP-streamPyPI · praisonai · fixed in 4.6.78
- CVE-2026-60087PraisonAI before 1.6.78 Tool Approval Cache BypassPyPI · praisonaiagents · fixed in 1.6.78
- CVE-2026-60085PraisonAI before 4.6.78 Unenforced Security Policy in Subprocess SandboxPyPI · praisonai · fixed in 4.6.78
- CVE-2026-59259n8n - Permission Bypass via Expression Parser Mismatch in External Secretsnpm · n8n · fixed in 1.123.61, 2.28.1, 2.27.4
- CVE-2026-59254n8n - External Secrets Disclosure via Workflow Node Expressionsnpm · n8n · fixed in 2.28.1, 2.27.4
- CVE-2026-56764Hono - Timing Attack in basicAuth and bearerAuth Middlewarenpm · hono · fixed in 4.11.10
- CVE-2026-56400open-webui - Remote Code Execution via CORS Misconfiguration and Session ValidationPyPI · open-webui · fixed in 0.3.33
- CVE-2026-56398Open WebUI - Stored Cross-Site Scripting via OAuth Picture Claim SVG Data URIPyPI · open-webui · fixed in 0.9.5
- CVE-2026-56375ImageMagick - Memory Leak in ASHLAR Coder Action FailureNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.11.1
- CVE-2026-56353n8n - Authentication Bypass in Chat Trigger Nodenpm · n8n · fixed in 1.123.22, 2.9.3, 2.10.1
- CVE-2026-56352n8n - Arbitrary File Read and Execution via ExecuteWorkflow localFile Parameternpm · n8n · fixed in 2.19.3
- CVE-2026-56349n8n - Guardrail Node Bypass via Crafted Inputnpm · n8n · fixed in 2.10.0