Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-54263Wagtail: Reflected XSS in dynamic image URL generator viewPyPI · wagtail · fixed in 7.3.3, 7.4.2
- CVE-2026-54262Wagtail: Pages translations can be created without page permissions when using simple_translationPyPI · wagtail · fixed in 7.0.8, 7.3.3, 7.4.2
- CVE-2026-54261Wagtail: Improper permission handling in image previewPyPI · wagtail · fixed in 7.0.8, 7.3.3, 7.4.2
- CVE-2026-54259Wagtail: Improper restriction handling on Documents and Images chosen endpointsPyPI · wagtail · fixed in 7.0.8, 7.3.3, 7.4.2
- CVE-2026-54260Wagtail: Denial of service via unbounded filter specs in the image previewPyPI · wagtail · fixed in 7.0.8, 7.3.3, 7.4.2
- CVE-2026-54720Silverstripe Framework: Possible XSS attack through media embedPackagist · silverstripe/framework · fixed in 6.2.2
- CVE-2026-55660TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeovernpm · @tinacms/app, tinacms · fixed in 2.5.6, 3.9.3
- CVE-2026-54074@tinacms/cli: Remote Code Execution via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labelsnpm · @tinacms/cli · fixed in 2.4.3
- CVE-2026-55661TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemesnpm · @tinacms/mdx, tinacms · fixed in 2.1.7, 3.9.3
- CVE-2026-58263Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carriernpm · jodit · fixed in 4.12.28
- CVE-2026-54756Jodit Editor: Prototype pollution via Jodit.configure() / ConfigMergenpm · jodit · fixed in 4.12.18
- CVE-2026-55886Jodit Editor: Prototype Pollution in Jodit via Jodit.modules.Helpers.set()npm · jodit · fixed in 4.12.26
- CVE-2026-54786Wasmtime: Leak in WASIp1 `fd_renumber` implementationcrates.io · wasmtime-wasi · fixed in 24.0.10, 45.0.2, 36.0.11 and more
- CVE-2026-55153mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"Maven · com.mchange:mchange-commons-java · fixed in 0.6.0
- CVE-2026-55688AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStoreMaven · org.asynchttpclient:async-http-client · fixed in 3.0.11, 2.16.0
- CVE-2026-54908Pion DTLS: Denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange messageGo · github.com/pion/dtls/v3 · fixed in 3.1.4
- CVE-2026-49858API Platform Core: Cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gatePackagist · api-platform/core, api-platform/hal +1 · fixed in 4.1.29, 4.2.25, 4.3.8
- CVE-2026-54164API Platform Core: Missing IRI type check enables resource type confusionPackagist · api-platform/core · fixed in 4.1.30, 4.2.26, 4.3.12
- CVE-2026-13760OS Command Injection in aws-cdk-lib Docker Bundlingnpm · aws-cdk-lib · fixed in 2.260.0
- CVE-2026-55597ImageMagick: Heap Buffer Over-Write in JP2 encoder when due to incorrect handling of argumentsNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-55595ImageMagick: Infinite Loop in connected-components when providing invalid argumentsNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-55594ImageMagick: Stack Overflow in MVG decoder due to missing depth check.NuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-55510ImageMagick: Use-After-Free in crafted 8BIM when identifying an imageNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-53467ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchangedNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-13769Overly permissive File Permissions in AWS CLIPyPI · awscli · fixed in 1.44.78
- CVE-2026-49119Gradio < 6.16.0 Path Traversal via FileExplorer.preprocess()PyPI · gradio · fixed in 6.16.0
- CVE-2026-53466ImageMagick: Heap Buffer Over-Read in XCF decoder due to integer conversion overflowNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-55628ImageMagick: Policy Bypass in concatenate operation due to missing checksNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-53489containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restoreGo · github.com/containerd/containerd, github.com/containerd/containerd/v2 · fixed in 2.1.9, 2.2.5, 2.3.2
- CVE-2026-53492containerd CRI checkpoint restore CDI annotation smugglingGo · github.com/containerd/containerd, github.com/containerd/containerd/v2 · fixed in 2.1.9, 2.2.5, 2.3.2