Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-61445PraisonAI before 4.6.78 Arbitrary File Write and Command ExecutionPyPI · praisonai · fixed in 4.6.78
- CVE-2026-61442PraisonAI Platform before 0.1.9 Authorization Bypass via PATCHPyPI · praisonai-platform · fixed in 0.1.9
- CVE-2026-61439PraisonAI before 4.6.78 Prompt Injection Defense BypassPyPI · praisonai · fixed in 4.6.78
- CVE-2026-61429PraisonAI before 1.6.78 SSRF via Crawl4AI Chromium backendPyPI · praisonaiagents · fixed in 1.6.78
- CVE-2026-61428PraisonAI AgentMail before 4.6.78 Message Injection via WebhookPyPI · praisonai · fixed in 4.6.78
- CVE-2026-61426PraisonAI before 1.7.3 Unauthenticated Agent Access via Insecure Defaultsnpm · praisonai · fixed in 1.7.3
- CVE-2026-60090PraisonAI before 4.6.78 SQL/CQL Injection via vector dimensionPyPI · praisonai · fixed in 4.6.78
- CVE-2026-60088PraisonAI before 4.6.78 Path Traversal via Custom CommandsPyPI · praisonai · fixed in 4.6.78
- CVE-2026-56763Hono - Prototype Pollution via __proto__ Key in parseBody with dot Optionnpm · hono · fixed in 4.12.7
- CVE-2026-56372ImageMagick - Heap Buffer Overflow Read via Unrecognized Magnify MethodNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.12.0
- CVE-2026-11913Mother May I - Critical - Unsupported - SA-CONTRIB-2026-045Packagist · drupal/mothermayi
- CVE-2026-11914Composer - Critical - Unsupported - SA-CONTRIB-2026-046Packagist · drupal/composer
- CVE-2026-11915Brute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-047Packagist · drupal/bfap_sb
- CVE-2026-15087Clean RESTful - Critical - Unsupported - SA-CONTRIB-2026-078Packagist · drupal/clean_node_api
- CVE-2026-15086Raw Formatter [Meta Tag Formatter] - Critical - Unsupported - SA-CONTRIB-2026-077Packagist · drupal/raw_formatter
- CVE-2026-15089Commerce guest registration - Critical - Unsupported - SA-CONTRIB-2026-079Packagist · drupal/commerce_guest_registration
- CVE-2026-55175Spinnaker: Improper yaml processing on kustomize bake operationsMaven · io.spinnaker.rosco:rosco-manifests · fixed in 2025.3.4, 2025.4.4, 2026.0.3 and more
- CVE-2026-44795Spinnaker: Non-safe yaml deserialization allowing RCE when using specific typesMaven · io.spinnaker.orca:orca-core, io.spinnaker.rosco:rosco-core · fixed in 2025.3.3, 2025.4.4, 2026.0.3
- CVE-2026-55808Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009Packagist · drupal/core · fixed in 10.5.12, 10.6.11, 11.2.14 and more
- CVE-2026-55807Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008Packagist · drupal/core · fixed in 10.5.12, 10.6.11, 11.2.14 and more
- CVE-2026-55806Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007Packagist · drupal/core · fixed in 10.5.12, 10.6.11, 11.2.14 and more
- CVE-2026-55804Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006Packagist · drupal/core · fixed in 10.5.12, 10.6.11, 11.2.14 and more
- CVE-2026-55803Drupal core - Critical - PHP object injection - SA-CORE-2026-005Packagist · drupal/core · fixed in 10.5.12, 10.6.11, 11.2.14 and more
- CVE-2026-15085AI SEO/GEO Analyzer - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-076Packagist · drupal/ai_seo · fixed in 1.1.3
- CVE-2026-15084UI Patterns (SDC in Drupal UI) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-075Packagist · drupal/ui_patterns · fixed in 2.0.17
- CVE-2026-15083ECA: Event - Condition - Action - Less critical - Information disclosure - SA-CONTRIB-2026-074Packagist · drupal/eca · fixed in 2.1.20, 3.0.12, 3.1.4
- CVE-2026-15082Siteimprove Analytics - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-073Packagist · drupal/siteimprove_analytics · fixed in 2.0.1
- CVE-2026-15081Location Selector - Critical - SQL Injection - SA-CONTRIB-2026-072Packagist · drupal/location_selector · fixed in 1.3.0
- CVE-2026-15080Ray Enterprise Translation - Moderately critical - Cross site request forgery - SA-CONTRIB-2026-071Packagist · drupal/lingotek · fixed in 4.0.4, 4.1.4, 11.0.4
- CVE-2026-15079Login Disable - Moderately critical - Access bypass - SA-CONTRIB-2026-070Packagist · drupal/login_disable · fixed in 2.1.4