Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-71328Flowise - Unverified Password Change via Account Settingsnpm · flowise-ui · fixed in 3.0.10
- CVE-2025-71327Flowise - Authentication Bypass via Unprotected Registration Endpointnpm · flowise
- CVE-2025-71324Flowise - Arbitrary File Read via chatId Parameternpm · flowise · fixed in 3.0.6
- CVE-2021-47987Parse Server - Arbitrary Code Execution via Malicious Version Tagsnpm · parse-server · fixed in 4.5.2, 4.10.0
- CVE-2021-47986Parse Server - Unreviewed Code Execution via Malicious Version Tagsnpm · parse-server · fixed in 4.5.2, 4.10.0
- CVE-2020-37256Grav - Cross-Site Scripting in Admin Plugin Page EditorPackagist · getgrav/grav · fixed in 1.6.30
- CVE-2026-12992Apicurio/apicurio-registry: apicurio-registry: ssrf via wsdl4j import dereference in wsdl full validationMaven · io.apicurio:apicurio-registry-schema-util-wsdl · fixed in 3.3.1, 3.2.6
- CVE-2026-12975Apicurio/apicurio-registry: apicurio-registry: unhardened saxparser in content-type detection leads to blind xxe / ssrf / billion-laughs dosMaven · io.apicurio:apicurio-registry-schema-util-common · fixed in 3.3.1, 3.2.6
- CVE-2026-11800Org.keycloak:keycloak-services: keycloak: authentication bypass via jwt algorithm confusionMaven · org.keycloak:keycloak-services · fixed in 26.6.4
- CVE-2026-46602Lack of limit on tile sizes in x/image/tiff in golang.org/x/imageGo · golang.org/x/image · fixed in 0.43.0
- CVE-2026-46601Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/imageGo · golang.org/x/image · fixed in 0.43.0
- CVE-2026-54917SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket accessGo · github.com/seaweedfs/seaweedfs · fixed in 0.0.0-20260526080459-dd1b4287899e
- CVE-2026-46608Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)PyPI · glances · fixed in 4.5.5
- CVE-2026-46607Glances: Insecure Pickle Deserialization in Version Cache Leads to Arbitrary Code ExecutionPyPI · glances · fixed in 4.5.5
- CVE-2026-53925Glances: Arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configurationPyPI · glances · fixed in 4.5.5
- CVE-2026-46606Glances: Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.pyPyPI · glances · fixed in 4.5.5
- CVE-2026-46611Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding AttackPyPI · glances · fixed in 4.5.5
- CVE-2026-54250K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot DecompressionGo · github.com/k3s-io/k3s · fixed in 1.35.3, 1.34.6, 1.33.10
- CVE-2026-54090File Browser: Command Allowlist Bypass via Shell Metacharacter InjectionGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.33.8
- CVE-2026-54088File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)Go · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.63.6
- CVE-2026-54089File Browser: Authentication Bypass via Proxy Auth Header ForgeryGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2
- CVE-2026-54091File Browser: Incorrect access control in public directory shares via rule path rebasingGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.63.6
- CVE-2026-54092File Browser: DoS Vulnerability on Public Login APIGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.63.6
- CVE-2026-54097File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefixGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.63.6
- CVE-2026-54093File Browser: Path traversal in download-as-zip/tar via Windows-style backslash separators in stored filenamesGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.63.6
- CVE-2026-54094File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scopeGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.63.14
- CVE-2026-54096File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent PathGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.63.7
- CVE-2026-55667File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanupGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.63.16
- CVE-2026-55180pnpm: Repository config can expand victim environment secrets into registry requests before scripts runnpm · pnpm · fixed in 10.34.2, 11.5.3
- CVE-2026-48995pnpm: Tarball hash of GitHub git dependencies is not stored in lockfilenpm · pnpm · fixed in 10.33.4, 11.0.7