Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-53765chrome-devtools-mcp: daemon.pid write follows symlinks in /tmp fallback runtime directorynpm · chrome-devtools-mcp · fixed in 1.1.0
- CVE-2026-53766chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing rootsnpm · chrome-devtools-mcp · fixed in 1.1.0
- CVE-2026-47110Tiptap for PHP < 2.1.1 DoS via Malformed href AttributePackagist · ueberdosis/tiptap-php · fixed in 2.1.1
- CVE-2026-50551SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell ContentGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260628153353-2d5d72223df4
- CVE-2026-54158SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()Go · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260628153353-2d5d72223df4
- CVE-2026-54070SiYuan: Stored XSS in Bazaar marketplace via package README event handlersGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260628153353-2d5d72223df4
- CVE-2026-54069SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin AllowlistGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260628153353-2d5d72223df4
- CVE-2026-54068SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIconGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260628153353-2d5d72223df4
- CVE-2026-54067SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()Go · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260628153353-2d5d72223df4
- CVE-2026-54066SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read)Go · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260628153353-2d5d72223df4
- CVE-2026-32315motionEye: World-Readable Configuration File Exposes Admin Password HashPyPI · motioneye · fixed in 0.44.0
- CVE-2026-52797Gogs: Overwriting critical files results in a denial of serviceGo · gogs.io/gogs · fixed in 0.14.0
- CVE-2026-52813Gogs: Path Traversal in organization name results in RCE through Git hooksGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-52812Gogs: LFS dedupe path leaks private repo content across tenantsGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-52811Gogs: UploadRepoFiles writes outside repo working tree via committed parent symGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-52810Gogs: Write to readonly repositories using receive-pack + service=git-upload-pack confusionGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-11998AngularJS XSS via SCE resource URL sanitization bypassnpm · angular
- CVE-2026-52809Gogs: Password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVESGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-31978motionEye: Arbitrary File Read via Path Traversal in Picture/Movie Preview EndpointPyPI · motioneye · fixed in 0.44.0
- CVE-2026-52808Gogs: Write-level collaborators can mutate admin-only repository settings via APIGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-52816Gogs: Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSSGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-52807Gogs: DOM-based XSS via Milestone Name on New Issue PageGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-52805Gogs: Migration Redirect Bypass Leads to Internal Repository TheftGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-52806Gogs: RCE via git rebase --exec argument injection in pull request mergeGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-52804Gogs: Privilege Escalation via Collaboration Access Mode ValidationGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-52799Gogs: Missing Authorization in Attachment DownloadGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-52801Gogs: Ability to import local repositories via Mirror SettingsGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-52800Gogs: CSRF Leading to Organization Owner TakeoverGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-52802Gogs: Open Redirect via redirect_to in GogsGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-52814Gogs: Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion)Go · gogs.io/gogs · fixed in 0.14.3