Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-59882guzzlehttp/psr7: Host Confusion via Weak URI Host ValidationPackagist · guzzlehttp/psr7 · fixed in 2.12.3
- CVE-2026-59879Immutable.js `List` 32-bit trie overflow → unrecoverable DoSnpm · immutable · fixed in 4.3.9, 5.1.8, 3.8.4
- CVE-2026-42505Invoking Encrypted Client Hello privacy leak in crypto/tlsGo · stdlib · fixed in 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-39822Root escape via symlink plus trailing slash in osGo · stdlib · fixed in 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-59880Immutable.js: Hash-collision algorithmic complexity denial of service in Immutable.Map/Setnpm · immutable · fixed in 4.3.9, 5.1.8, 3.8.4
- CVE-2026-59725Socket.IO: Engine.IO Polling Transport Connection Exhaustionnpm · engine.io · fixed in 6.6.7
- CVE-2026-59724Socket.IO: Engine.IO WebTransport SID DoSnpm · engine.io · fixed in 6.6.7
- CVE-2026-59876protobufjs: Text Format string map parsing can mutate returned map object prototypenpm · protobufjs · fixed in 8.6.5
- CVE-2026-59877protobufjs: Denial of Service via infinite loop in .proto option parsingnpm · protobufjs · fixed in 7.6.5, 8.6.6
- CVE-2026-53951Copier: trust-prefix bypass via path traversal runs tasks unpromptedPyPI · copier · fixed in 9.15.2
- CVE-2026-59871node-tar: Process crash via PAX numeric path type confusionnpm · tar · fixed in 7.5.18
- CVE-2026-59874node-tar: Negative tar entry size causes infinite loop in archive replacenpm · tar · fixed in 7.5.18
- CVE-2026-59873node-tar: Decompression/parse DoS via unlimited inputnpm · tar · fixed in 7.5.19
- CVE-2026-59875node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath recordsnpm · tar · fixed in 7.5.17
- CVE-2026-59868js-yaml: YAML merge-key chains can force quadratic CPU consumptionnpm · js-yaml · fixed in 5.2.0
- CVE-2026-59869js-yaml: YAML merge-key chains can force quadratic CPU consumptionnpm · js-yaml · fixed in 3.15.0, 4.3.0
- CVE-2026-59870js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsingnpm · js-yaml · fixed in 5.2.1
- CVE-2026-55761Portainer: Unauthenticated Restore Endpoint Allows Admin Takeover on Uninitialised Portainer InstancesGo · github.com/portainer/portainer · fixed in 2.39.4, 2.43.0
- CVE-2026-14967Path traversal in github_workflows allows writing artifacts outside output directoryPyPI · bbot · fixed in 3.0.0
- CVE-2026-14966Symlink guard bypass in unarchive module allows planting symlinks during extractionPyPI · bbot · fixed in 3.0.0
- CVE-2026-57439CyberChef: Prototype pollution in Series Chart operationnpm · cyberchef · fixed in 11.2.0
- CVE-2026-55668File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scopeGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.63.16
- CVE-2026-55873SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table bucketsGo · github.com/seaweedfs/seaweedfs · fixed in 0.0.0-20260614205536-b13463880c1f
- CVE-2026-55874SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object readGo · github.com/seaweedfs/seaweedfs · fixed in 0.0.0-20260612000715-b44cf51fe931
- CVE-2026-15035bentoml OpenLLM Model Repository Directory Name common.py async_run_command command injectionPyPI · bentoml
- CVE-2026-60092AVideo - Stored Cross-Site Scripting via Unescaped User-Agent in Participants PanelPackagist · wwbn/avideo
- CVE-2026-59257n8n - SQL Injection in MySQL v1 executeQuery Operation via Expression Interpolationnpm · n8n · fixed in 1.123.61, 2.28.1, 2.27.4
- CVE-2026-59253n8n - Improper Authorization in Workflow Assignment to Foldersnpm · n8n · fixed in 2.28.0
- CVE-2026-58657Grav - Stored CSS Injection via Markdown Image resize() ActionPackagist · getgrav/grav · fixed in 2.0.0
- CVE-2026-56778n8n - Authorization Bypass in Public API Execution Retry Endpointnpm · n8n · fixed in 2.26.2, 2.25.7