Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-55882Tilt: Unauthenticated pprof debug endpoints on the Tilt HUD serverGo · github.com/tilt-dev/tilt · fixed in 0.37.4
- CVE-2026-55884Tilt: Missing authentication on the network-exposed Tilt HUD serverGo · github.com/tilt-dev/tilt · fixed in 0.37.4
- CVE-2026-59155Nezha Monitoring: DDNS and Notification credential exposure via unredacted list APIGo · github.com/nezhahq/nezha · fixed in 2.2.5
- CVE-2026-49844Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson()Maven · org.apache.logging.log4j:log4j-api · fixed in 2.25.5, 2.26.1
- CVE-2026-57584Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoSPackagist · phalcon/cphalcon · fixed in 5.15.0
- CVE-2026-54736Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel)Packagist · phalcon/cphalcon · fixed in 5.14.1
- CVE-2026-9726Drupal AlternativeCommerce (Basket) - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2026-038Packagist · drupal/basket · fixed in 2.1.17
- CVE-2026-58499Path traversal in EverOS /api/v1/memory/add via unvalidated sender_idPyPI · everos · fixed in 1.0.1
- CVE-2026-55229Gotenberg: SSRF via LibreOffice document processingGo · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8 · fixed in 8.34.0
- CVE-2026-55405LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvectorMaven · dev.langchain4j:langchain4j-mariadb, dev.langchain4j:langchain4j-pgvector · fixed in 1.2.1-beta8, 1.5.1-beta11, 1.11.8-beta19 and more
- CVE-2026-55481Snipe-IT: CSS Injection via `header_color` SettingPackagist · snipe/snipe-it · fixed in 8.6.2
- CVE-2026-55475Snipe-IT: Import created_by can be overwrittenPackagist · snipe/snipe-it · fixed in 8.6.1
- CVE-2026-55469Snipe-IT: Path traversal vulnerability via CSV import `image` fieldPackagist · snipe/snipe-it · fixed in 8.6.2
- CVE-2026-55461Snipe-IT: Open Redirect After User EditPackagist · snipe/snipe-it · fixed in 8.6.2
- CVE-2026-55479Snipe-IT: Incorrect permission for legacy license checkin APIPackagist · snipe/snipe-it · fixed in 8.6.2
- CVE-2026-55452Snipe-IT: CSV formula injection in Activity Report exportPackagist · snipe/snipe-it · fixed in 8.6.2
- CVE-2026-55466Snipe-IT: Stored XSS via inline-served attachmentPackagist · snipe/snipe-it · fixed in 8.6.2
- CVE-2026-55515Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpointPackagist · snipe/snipe-it · fixed in 8.6.2
- CVE-2026-55462Snipe-IT: Authorization bypass on print inventory pagePackagist · snipe/snipe-it · fixed in 8.6.1
- CVE-2026-55464Snipe-IT: Stored XSS via Markdown custom fieldPackagist · snipe/snipe-it · fixed in 8.6.2
- CVE-2026-55460Snipe-IT: Authorization bypass on bulk editing usersPackagist · snipe/snipe-it · fixed in 8.6.2
- CVE-2026-55472Snipe-IT: API Location Creation Bypasses FMCS Parent-Child Company Boundary ValidationPackagist · snipe/snipe-it · fixed in 8.6.2
- CVE-2026-55476Snipe-IT: Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin ParameterPackagist · snipe/snipe-it · fixed in 8.6.0
- CVE-2026-61459MCP Server Kubernetes < 3.9.0 Argument Injection via kubectl Structured Toolsnpm · mcp-server-kubernetes · fixed in 3.9.0
- CVE-2026-55478Snipe-IT: Missing object-level authorization in Kits APIPackagist · snipe/snipe-it · fixed in 8.6.2
- CVE-2026-55843Snipe-IT: Improper Privilege ManagementPackagist · snipe/snipe-it · fixed in 8.6.0
- CVE-2026-55516Snipe-IT: Cross-company asset maintenance re-parenting via API updatePackagist · snipe/snipe-it · fixed in 8.6.2
- CVE-2026-55474Snipe-IT: Directory traversal in displaySigPackagist · snipe/snipe-it · fixed in 8.5.0
- CVE-2026-54329Snipe-IT: Cross-Tenant Accessory Injection in Snipe-IT APIPackagist · snipe/snipe-it · fixed in 8.6.2
- CVE-2026-59151Prowler: SAML Domain Claiming Enables Cross-Tenant Account TakeoverPyPI · prowler-cloud · fixed in 5.30.3