Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-116693dd-trace: ReDOS in URL query string obfuscationnpm · dd-trace · fixed in 5.131.1, 6.20.1
- CVE-2026-116692MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact…PyPI · mlflow · fixed in 3.17.0
- CVE-2026-116691MLflow CrewAI autologging records LLM provider API keys in logged trace spansPyPI · mlflow · fixed in 3.17.0
- CVE-2026-116690MLflow: Arbitrary file read on unauthenticated MLflow servers via prompt model version sourcePyPI · mlflow · fixed in 3.17.0
- CVE-2026-116689follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirectsnpm · follow-redirects · fixed in 1.16.2
- CVE-2026-116688CKEditor: Cross-site scripting (XSS) in the engine packagenpm · @ckeditor/ckeditor5-engine, ckeditor5 · fixed in 47.7.4, 48.5.1
- CVE-2026-116687CKEditor: Cross-site scripting (XSS) in the engine packagenpm · @ckeditor/ckeditor5-engine, ckeditor5 · fixed in 47.7.4, 48.5.1
- CVE-2026-116686Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemasPyPI · mcp · fixed in 2.2.0, 1.30.0
- CVE-2026-116685Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodiesPyPI · mcp · fixed in 2.2.0, 1.30.0
- CVE-2026-116684Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource serverPyPI · mcp · fixed in 2.2.0, 1.30.0
- GHSA-F897-62HF-6GXQMCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch lengthnpm · @modelcontextprotocol/hono, @modelcontextprotocol/node +2 · fixed in 2.0.1, 2.1.0, 1.30.1
- CVE-2026-116683CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive valuesGo · github.com/ctfer-io/terraform-provider-ctfd, github.com/ctfer-io/terraform-provider-ctfd/v2 · fixed in 2.8.2
- CVE-2026-116682FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directoryGo · github.com/gtsteffaniak/filebrowser/backend · fixed in 0.0.0-20260814233832-4126edeb07a0
- CVE-2026-116679Neko: Authorization bypass in legacy WebRTC input handlingGo · github.com/m1k1o/neko/server · fixed in 0.0.0-20260805142851-395ca1a6f62b
- CVE-2026-116677OpenWISP Controller CA CRL REST API does not scope requests to managed organizationsPyPI · openwisp-controller · fixed in 1.3.2
- CVE-2026-116676Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during planGo · github.com/runatlantis/atlantis · fixed in 0.47.1
- GHSA-WF6J-7HVR-GR93Hydra legacy target blacklist permits unsafe PyYAML loadingPyPI · hydra-core · fixed in 1.3.8, 1.4.0rc3
- CVE-2026-116675TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serializationnpm · tinymce · fixed in 8.9.3, 7.9.4
- CVE-2026-116674systeminformation: Prototype pollution in `networkStats()` via the interface namenpm · systeminformation · fixed in 5.33.13
- CVE-2026-116673systeminformation: Path traversal in Linux networkStats() allows symlink-based file disclosure outside /sys/class/netnpm · systeminformation · fixed in 5.33.14
- CVE-2026-116672Authlib RFC 7592 examples omit registration-access-token client bindingPyPI · authlib · fixed in 1.9.1
- CVE-2026-54462knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustionGo · knative.dev/pkg · fixed in 0.0.0-20260531000007-52dbd5ece63f
- CVE-2026-109823Host filesystem path disclosure via DNS rebindingHex · tidewave · fixed in 0.9.2
- GHSA-3W55-933P-8PV5Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File StoragePyPI · strands-agents · fixed in 1.48.0
- GHSA-763V-5PJM-FX36Strands Agents: Default FileSessionManager storage is world-readable on shared systemsPyPI · strands-agents · fixed in 1.48.0
- GHSA-G5FF-637F-6Q2MLiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`PyPI · litellm · fixed in 1.95.0
- GHSA-HHWW-MRG2-969HLiteLLM vulnerable to reflected XSS in /sso/debug/callbackPyPI · litellm · fixed in 1.85.0
- CVE-2026-117601Electrum before 4.8.3 Missing Signature Verification of Mempool TransactionsPyPI · electrum · fixed in 4.8.3
- CVE-2026-117538REDAXO before 5.21.0 Reflected XSS via Packages API function ParameterPackagist · redaxo/source · fixed in 5.21.0
- CVE-2026-117537REDAXO before 5.21.0 Reflected XSS via Metainfo API type ParameterPackagist · redaxo/source · fixed in 5.21.0