Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-58657Grav - Stored CSS Injection via Markdown Image resize() ActionPackagist · getgrav/grav · fixed in 2.0.0
- CVE-2026-56778n8n - Authorization Bypass in Public API Execution Retry Endpointnpm · n8n · fixed in 2.26.2, 2.25.7
- CVE-2026-56776n8n - Incorrect OAuth Scope Validation in Workflow Test Run Endpointnpm · n8n · fixed in 1.123.55, 2.26.2, 2.25.7
- CVE-2026-56775n8n - Incorrect OAuth Scope Validation in Evaluation Test Runs Endpointsnpm · n8n · fixed in 1.123.55, 2.26.2, 2.25.7
- CVE-2026-56374ImageMagick - Heap Buffer Overflow in FTXT Encoder via format ParameterNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.12.0
- CVE-2026-56362ImageMagick - Heap-buffer-overflow Read in GetPixelIndex via OpenPixelCache Metadata DesynchronizationNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.3
- CVE-2026-56360n8n - Webhook Forgery via Unsigned POST Requests in ZendeskTriggernpm · n8n · fixed in 1.123.18, 2.6.2
- CVE-2026-56359n8n - Cross-Site Scripting in Credential Management OAuth2 Authorization URLnpm · n8n · fixed in 2.8.0, 2.6.4
- CVE-2026-56273Flowise - Path Traversal in Vector Store basePath Parameternpm · flowise, flowise-components · fixed in 3.1.0
- CVE-2026-44840Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL QueryGo · github.com/dgraph-io/dgraph, github.com/dgraph-io/dgraph/v25 +1 · fixed in 25.3.4
- CVE-2026-54061Dgraph Alpha group stores can be replaced via unauthenticated external snapshot importGo · github.com/dgraph-io/dgraph, github.com/dgraph-io/dgraph/v25 · fixed in 25.3.5
- CVE-2026-55438Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofingGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.29.17, 2.32.7, 2.33.8 and more
- CVE-2026-55437Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine componentGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.29.17, 2.32.7, 2.33.8 and more
- CVE-2026-55436Coder's AI Bridge Proxy skips TLS certificate verification in default configurationGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.32.7, 2.33.8, 2.34.2
- CVE-2026-55433Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containersGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.34.2, 2.33.8, 2.32.7 and more
- CVE-2026-55432Coder's sub-agent app registration bypasses template port-sharing policy enforcementGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.34.2, 2.33.8, 2.32.7 and more
- CVE-2026-55431Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace appsGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.29.17, 2.32.7, 2.33.8 and more
- CVE-2026-55430Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data accessGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.34.2, 2.33.8, 2.32.7 and more
- CVE-2026-55429Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app IDGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.29.17, 2.32.7, 2.33.8 and more
- CVE-2026-55428Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinatorGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.29.17, 2.32.7, 2.33.8 and more
- CVE-2026-55427Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`Go · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.29.17, 2.32.7, 2.33.8 and more
- CVE-2026-55079Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of serviceGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.34.2, 2.33.8, 2.32.7 and more
- CVE-2026-55078Coder: Zip upload decompression lacks aggregate size limit, enabling denial of serviceGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.29.17, 2.32.7, 2.33.8 and more
- CVE-2026-55077Coder: User-admin role can reset owner account passwordGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.34.2, 2.33.8, 2.32.7 and more
- CVE-2026-55076Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linkingGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.34.2, 2.33.8, 2.32.7 and more
- GO-2026-5932The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issuesGo · golang.org/x/crypto
- CVE-2026-55075Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypassGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.29.17, 2.32.7, 2.33.8 and more
- CVE-2026-58266Anki: User scripts in iframes have access to the internal Anki APIPyPI · aqt · fixed in 25.9.4
- CVE-2026-59153Anki's local HTTP server does not sufficiently validate requestsPyPI · aqt · fixed in 25.9.3
- CVE-2026-46354Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theftGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.24.5, 2.29.13, 2.30.8 and more