Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-52798Gogs: Stored XSS in `.ipynb` PreviewGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-52796Gogs: DoS in rendering issue index patternGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-47267Gogs: SSRF in webhook deliveriesGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-25119Gogs: Authentication Bypass via Unvalidated Reverse Proxy HeadersGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2025-64719Gogs: Denial of Service in repository/wiki file listing web pagesGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-52815Gogs: Unauthenticated Organization Teams Information Disclosure via APIGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-23879py7zr: Arbitrary File Write VulnerabilityPyPI · py7zr · fixed in 1.1.3
- CVE-2026-53943Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview headernpm · ghost · fixed in 6.37.0
- CVE-2026-53944Ghost: Private IP filtering bypass to make server-side requests to internal servicesnpm · ghost · fixed in 6.21.1
- CVE-2026-53945Ghost: Server-side request forgery via DNS rebinding in external request handlingnpm · ghost · fixed in 6.21.2
- CVE-2026-53946Ghost: Mobiledoc image-size fetch SSRFnpm · ghost · fixed in 6.21.2
- CVE-2026-53947Ghost: Member existence leak via magic link sign-in responsenpm · ghost · fixed in 6.21.2
- CVE-2026-53948Ghost: File Upload Content-Type Spoofingnpm · ghost · fixed in 6.21.1
- CVE-2026-53949Ghost Content API filter bypass reveals private fieldsnpm · ghost · fixed in 6.21.2
- CVE-2026-53950@tryghost/activitypub: XSS in Ghost's ActivityPub clientnpm · @tryghost/activitypub · fixed in 3.1.0
- CVE-2026-49980Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fixGo · github.com/ncw/rclone, github.com/rclone/rclone · fixed in 1.74.3
- CVE-2026-44017Docling: Unsafe Zip Extraction in EasyOCR Model DownloadPyPI · docling · fixed in 2.91.0
- CVE-2026-44022Docling: Potential Path Traversal via LaTeX \includegraphics and \input CommandsPyPI · docling · fixed in 2.91.0
- CVE-2026-44020Docling: Unsafe XML Entity Expansion in USPTO Patent BackendPyPI · docling · fixed in 2.74.0
- CVE-2026-44016Docling: Unsafe Playwright-based HTML RenderingPyPI · docling · fixed in 2.91.0
- CVE-2026-49851Mistune: Potential DoS via quadratic-time parsing in parse_link_textPyPI · mistune · fixed in 3.3.0
- CVE-2026-54297Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parametersRubyGems · faraday · fixed in 2.14.3, 1.10.6
- CVE-2026-54906concurrent-ruby: ReadWriteLock allows wrong-thread write release and stray read-release counter corruptionRubyGems · concurrent-ruby · fixed in 1.3.7
- CVE-2026-54904concurrent-ruby: `AtomicReference#update` livelocks when the stored value is `Float::NAN`RubyGems · concurrent-ruby · fixed in 1.3.7
- CVE-2026-54905concurrent-ruby: `ReentrantReadWriteLock` read-count overflow grants a write lock without exclusivityRubyGems · concurrent-ruby · fixed in 1.3.7
- CVE-2026-55488motionEye's Absolute Path Traversal in Media File Handlers Allows Arbitrary File ReadPyPI · motioneye · fixed in 0.44.0
- CVE-2026-56121Feast < 0.63.0 Unauthenticated RCE via ApplyFeatureView gRPC DeserializationPyPI · feast · fixed in 0.63.0
- CVE-2026-12986A critical vulnerability in Admin GUI in Payara Server Full 4.x, 5.x, 6.x, 7.x, 7.2026.x, 6.2025.x, 6.2024.x on All platforms that allows thMaven · fish.payara.distributions:payara · fixed in 7.2026.6
- CVE-2026-12537Unauthenticated Remote Code Execution in Gemini CLI CI/CD Workflowsnpm · @google/gemini-cli · fixed in 0.39.1, 0.40.0-preview.3
- CVE-2026-57307A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers with Overall/Read permissionMaven · io.jenkins.plugins:zdevops