Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-25712Gitea organization permission APIs expose private visibility informationGo · code.gitea.io/gitea · fixed in 1.25.5
- CVE-2026-25038Gitea private organization labels are visible to unauthorized usersGo · code.gitea.io/gitea · fixed in 1.26.3
- CVE-2026-24690Gitea pull-request branch updates use insufficient permission checksGo · code.gitea.io/gitea · fixed in 1.25.5
- CVE-2026-24451Gitea fork synchronization can expose private parent repository dataGo · code.gitea.io/gitea · fixed in 1.26.3
- CVE-2026-22874Gitea webhook and migration allow-list filtering permits SSRFGo · code.gitea.io/gitea · fixed in 1.26.3
- CVE-2026-22555Gitea organization forks can expose organization secrets without create permissionGo · code.gitea.io/gitea · fixed in 1.26.0
- CVE-2026-22547Gitea repository creation accepts invalid field valuesGo · code.gitea.io/gitea · fixed in 1.25.5
- CVE-2026-20909Gitea tracked-time list endpoint has insufficient permission checksGo · code.gitea.io/gitea · fixed in 1.25.5
- CVE-2026-20896Gitea Docker image trusts spoofable reverse-proxy headers by defaultGo · code.gitea.io/gitea · fixed in 1.26.3
- CVE-2026-20779Gitea TOTP single-use enforcement defect allows OTP replayGo · code.gitea.io/gitea · fixed in 1.26.3
- CVE-2026-20706Gitea repository archive downloads bypass token scope checksGo · code.gitea.io/gitea · fixed in 1.26.2
- CVE-2026-14631webpack-dev-server vulnerable to denial of service via a malformed Host or Origin headernpm · webpack-dev-server · fixed in 5.2.6
- CVE-2026-14620webpack-dev-server vulnerable to cross-site request forgery via internal developer endpointsnpm · webpack-dev-server · fixed in 5.2.6
- CVE-2026-52830fast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram session protectionPyPI · fast-mcp-telegram · fixed in 0.19.1
- CVE-2026-50282Craft CMS: Unauthorized Deletion of Destination Folders During Forced MovesPackagist · craftcms/cms · fixed in 5.9.21, 4.17.14
- CVE-2026-50281Craft CMS: Mass assignment via id in newAttributes during bulk duplicate overwrites existing elementsPackagist · craftcms/cms · fixed in 5.9.21
- CVE-2026-44935Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm DeployerGo · github.com/rancher/fleet · fixed in 0.12.15, 0.13.11, 0.14.6 and more
- CVE-2026-58653PraisonAI - Authorization Bypass via Unvalidated project_id in Issue Create/UpdatePyPI · praisonai-platform · fixed in 0.1.8
- CVE-2026-8147Authorization Bypass in mlflow/mlflowPyPI · mlflow · fixed in 3.13.0rc0
- CVE-2026-50280Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save checkPackagist · craftcms/cms · fixed in 5.9.21
- CVE-2026-50279Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gapPackagist · craftcms/cms · fixed in 5.9.21
- CVE-2026-55794Craft CMS: Potential authenticated Remote Code Execution via referrer redirectPackagist · craftcms/cms · fixed in 5.10.0
- CVE-2026-55792Craft CMS: Sensitive File Disclosure / Server-Side File ReadPackagist · craftcms/cms · fixed in 4.18.0, 5.10.0
- CVE-2026-55791Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJsPackagist · craftcms/cms · fixed in 5.10, 4.18
- CVE-2026-55790Craft CMS: DOM XSS via GitHub issue title in CraftSupport widgetPackagist · craftcms/cms · fixed in 5.9.23, 4.17.16
- CVE-2026-50284Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assetsPackagist · craftcms/cms · fixed in 5.9.22, 4.17.15
- CVE-2026-50283Craft CMS: Unauthorized Deletion of Source Assets During File ReplacementPackagist · craftcms/cms · fixed in 5.9.21, 4.17.14
- CVE-2026-55793Craft CMS: Stored XSS via Structure entry title in table viewPackagist · craftcms/cms · fixed in 5.9.53
- CVE-2026-54712OpenTelemetry Javaagent RMI context propagation allows resource exhaustionMaven · io.opentelemetry.javaagent:opentelemetry-javaagent · fixed in 2.27.0
- CVE-2026-54704OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text PasswordsMaven · io.opentelemetry.javaagent:opentelemetry-javaagent · fixed in 2.28.0-alpha