Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-58591Colorbox - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-069Packagist · drupal/colorbox · fixed in 2.1.5
- CVE-2026-58590FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-068Packagist · drupal/flowdrop · fixed in 1.6.0
- CVE-2026-58589FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-067Packagist · drupal/flowdrop · fixed in 1.6.0
- CVE-2026-58588Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-066Packagist · drupal/canvas · fixed in 1.4.2, 1.5.2, 1.6.1 and more
- CVE-2026-58587Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-065Packagist · drupal/canvas · fixed in 1.4.2, 1.5.2, 1.6.1 and more
- CVE-2026-13244Tealium iQ Tag Management - Critical - PHP object injection - SA-CONTRIB-2026-064Packagist · drupal/tealiumiq · fixed in 2.4.0
- CVE-2026-13243Salesforce Suite - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-063Packagist · drupal/salesforce · fixed in 5.1.3
- CVE-2026-13242Geolocation Field - Critical - SQL Injection - SA-CONTRIB-2026-062Packagist · drupal/geolocation · fixed in 3.15.0
- CVE-2026-13241Paragraphs - Moderately critical - Access bypass - SA-CONTRIB-2026-061Packagist · drupal/paragraphs · fixed in 1.21.0
- CVE-2026-13240Paragraphs - Less critical - Access bypass - SA-CONTRIB-2026-060Packagist · drupal/paragraphs · fixed in 1.21.0
- CVE-2026-13239WissKI - Critical - Access bypass - SA-CONTRIB-2026-059Packagist · drupal/wisski · fixed in 4.2.0
- CVE-2026-13238Commerce Realex / Global Payments - Moderately critical - Access Bypass - SA-CONTRIB-2026-058Packagist · drupal/commerce_realex · fixed in 3.0.2
- CVE-2026-13237AI Agents - Moderately critical - Information disclosure, Access bypass - SA-CONTRIB-2026-057Packagist · drupal/ai_agents · fixed in 1.1.4, 1.2.5, 1.3.1
- CVE-2026-13236AI Agents - Less critical - Access bypass - SA-CONTRIB-2026-056Packagist · drupal/ai_agents · fixed in 1.1.4, 1.2.5, 1.3.1
- CVE-2026-13235AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-055Packagist · drupal/ai · fixed in 1.2.17, 1.3.8, 1.4.3
- CVE-2026-13234AI (Artificial Intelligence) - Moderately critical - Information Disclosure / Cross-site Scripting - SA-CONTRIB-2026-054Packagist · drupal/ai · fixed in 1.2.17, 1.3.8, 1.4.3
- CVE-2026-13233OpenAI Provider - Moderately critical - Server-side Request Forgery - SA-CONTRIB-2026-053Packagist · drupal/ai_provider_openai · fixed in 1.1.1, 1.2.2
- CVE-2026-13232Advanced Content Feedback (aka admin_feedback) - Moderately critical - Access bypass / Insecure Direct Object Reference (IDOR) - SA-CONTRIB-2026-052Packagist · drupal/admin_feedback · fixed in 2.8.0
- CVE-2026-13231Advanced Content Feedback (aka admin_feedback) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-051Packagist · drupal/admin_feedback · fixed in 2.8.0
- CVE-2026-55810Plotly.js Graphing - Critical - PHP object injection - SA-CONTRIB-2026-050Packagist · drupal/plotly_js · fixed in 3.0.2
- CVE-2026-55809Flag attendance field - Critical - PHP object injection - SA-CONTRIB-2026-049Packagist · drupal/flag_attendance_field · fixed in 1.2.0
- CVE-2026-55187Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanisms (follow-up to CVE-2026-27808)Go · github.com/axllent/mailpit · fixed in 1.30.2
- CVE-2026-12535Formatter Field - Critical - PHP object injection - SA-CONTRIB-2026-048Packagist · drupal/formatter_field · fixed in 2.0.0
- CVE-2026-11909Examples for Developers - Moderately critical - Access bypass - SA-CONTRIB-2026-044Packagist · drupal/examples · fixed in 4.0.6
- CVE-2026-11908Tagify - Moderately critical - Cross-site scripting (XSS) - SA-CONTRIB-2026-043Packagist · drupal/tagify · fixed in 1.2.52
- CVE-2026-10770Anti-Spam by CleanTalk - Moderately critical - Cross site scripting - SA-CONTRIB-2026-042Packagist · drupal/cleantalk · fixed in 9.7.1
- CVE-2026-10769Commerce Core - Moderately critical - Cross site scripting - SA-CONTRIB-2026-041Packagist · drupal/commerce · fixed in 3.3.6
- CVE-2026-10768LocalGov Workflows - Moderately critical - Information disclosure - SA-CONTRIB-2026-039Packagist · drupal/localgov_workflows · fixed in 1.6.0
- CVE-2026-55883Tilt: Cross-site WebSocket hijacking of the Tilt HUD streamGo · github.com/tilt-dev/tilt · fixed in 0.37.4
- CVE-2026-55882Tilt: Unauthenticated pprof debug endpoints on the Tilt HUD serverGo · github.com/tilt-dev/tilt · fixed in 0.37.4