Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-56379ImageMagick - Command Injection via SVG DecoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.3
- CVE-2026-56376ImageMagick - Heap Use-After-Free in Meta CoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.10.3
- CVE-2026-56371ImageMagick - Memory Leak in TXT File Processing via Texture AttributeNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.3
- CVE-2026-56315picklescan - Remote Code Execution via Unblocked Standard Library ModulesPyPI · picklescan · fixed in 1.0.4
- CVE-2026-56301Nuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linuxnpm · nuxt · fixed in 4.4.7, 3.21.7
- CVE-2026-56275Flowise - Server-Side Request Forgery via Execute Flow Base URLnpm · flowise, flowise-components · fixed in 3.1.0
- CVE-2026-56274Flowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccessnpm · flowise, flowise-components · fixed in 3.1.2
- CVE-2026-56263Crawl4AI - Stored Cross-Site Scripting in Monitor DashboardPyPI · crawl4ai · fixed in 0.8.7
- CVE-2026-56258Crawl4AI - Arbitrary File Write via output_path Symlink and TOCTOUPyPI · crawl4ai · fixed in 0.8.8
- CVE-2025-71376picklescan - Arbitrary Code Execution via Undetected idlelib.autocomplete.AutoComplete.fetch_completionsPyPI · picklescan · fixed in 0.0.29
- CVE-2025-71370picklescan - Remote Code Execution via torch.jit.unsupported_tensor_ops.execWrapperPyPI · picklescan · fixed in 0.0.28
- CVE-2025-71365picklescan - Arbitrary Code Execution via numpy.f2py.crackfortran.myeval Detection BypassPyPI · picklescan · fixed in 0.0.33
- CVE-2025-71341picklescan - Remote Code Execution via Undetected profile.Profile.runctxPyPI · picklescan · fixed in 0.0.29
- CVE-2025-71337Flowise - Unverified Email Change via Account Profile Endpointnpm · flowise-ui · fixed in 3.0.10
- CVE-2023-54365Traefik - Denial of Service via HTTP/2 Request HandlingGo · github.com/traefik/traefik · fixed in 2.10.5, 3.0.0-beta4
- CVE-2026-12866All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API.npm · expr-eval
- CVE-2026-47155vLLM: Artifact Pin Decay in vLLM allows pinned deployments to load unpinned code, weights, and processorsPyPI · vllm · fixed in 0.22.0
- CVE-2026-41523vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code ExecutionPyPI · vllm · fixed in 0.22.0
- CVE-2026-54232vLLM: Dependency Confusion Vulnerability in vLLM DockerfilePyPI · vllm · fixed in 0.22.1
- CVE-2026-54233vLLM: OOM Denial of Service via Audio Decompression BombPyPI · vllm · fixed in 0.24.0
- CVE-2026-54236vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic routerPyPI · vllm · fixed in 0.24.0
- CVE-2026-54235vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernelsPyPI · vllm · fixed in 0.24.0
- CVE-2026-48746vLLM: OpenAI auth bypassPyPI · vllm · fixed in 0.22.0
- CVE-2026-53923vLLM GGUF Kernels: int64_t to int truncation of tensor dimensions causes GPU buffer overflowPyPI · vllm · fixed in 0.24.0
- CVE-2026-55409Filament: Disabled RichEditor field state can be used for XSSPackagist · filament/forms · fixed in 3.3.53
- CVE-2026-48067Filament: Inconsistent scope enforcement for AttachAction and AssociateAction Select fieldsPackagist · filament/actions, filament/tables · fixed in 4.11.4, 5.6.4, 3.3.51
- CVE-2026-48167Filament: Unvalidated ImageColumn and ImageEntry values can be used for XSSPackagist · filament/infolists, filament/tables · fixed in 4.11.5, 5.6.5
- CVE-2026-48500Filament: Unauthenticated temporary file upload on auth pagesPackagist · filament/filament · fixed in 4.11.5, 5.6.5, 3.3.52
- CVE-2026-48166Filament: Timing-based user enumeration on login pagePackagist · filament/filament · fixed in 4.11.5, 5.6.5
- CVE-2026-48505Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submissionPackagist · filament/filament · fixed in 4.11.5, 5.6.5