Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-54267Angular Client Hydration DOM Clobbering & Response-Cache Poisoningnpm · @angular/core · fixed in 22.0.1, 21.2.17, 20.3.25
- CVE-2026-54266Angular: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoningnpm · @angular/common · fixed in 22.0.1, 21.2.17, 20.3.25
- CVE-2026-54265Angular: Two-Way Property Binding Sanitization Bypass (XSS)npm · @angular/compiler · fixed in 22.0.1, 21.2.17, 20.3.25
- CVE-2026-12479Path Traversal in keras-team/kerasPyPI · keras · fixed in 3.12.3, 3.15.0
- CVE-2026-52725Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)npm · @angular/core · fixed in 21.2.15, 22.0.0-rc.2, 19.2.23 and more
- CVE-2026-50557Angular: Template and Attribute Namespace Sanitization Bypass (XSS)npm · @angular/compiler, @angular/core · fixed in 21.2.15, 22.0.0-rc.2, 20.3.22 and more
- CVE-2026-53550js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliasesnpm · js-yaml · fixed in 4.2.0, 3.15.0
- CVE-2026-53655node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)npm · tar · fixed in 7.5.16
- CVE-2026-56104Chainlit < 2.10.1 Session Hijacking via WebSocket Session RestorationPyPI · chainlit · fixed in 2.10.1
- CVE-2026-8823User Manager can demote bot accounts to guest without bot-management permissionGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.18+incompatible, 11.7.1+incompatible, 11.7.1 and more
- CVE-2026-6062IDOR in Jira plugin subscription edit endpointGo · github.com/mattermost/mattermost-server · fixed in 11.7.1, 11.6.3, 11.5.6 and more
- CVE-2026-6673Mattermost Jira plugin had unauthenticated {{/ac/installed}} lifecycle callback during pending Jira Cloud installGo · github.com/mattermost/mattermost-server · fixed in 10.11.18+incompatible, 11.5.6+incompatible, 11.6.3+incompatible and more
- CVE-2026-8074Improper Permission Check Allows User Manager to Deactivate Bot AccountsGo · github.com/mattermost/mattermost-server · fixed in 10.11.18+incompatible, 11.7.1+incompatible, 11.7.1 and more
- CVE-2026-9162Global session revocation does not invalidate active WebSocket connectionsGo · github.com/mattermost/mattermost-server · fixed in 10.11.18+incompatible, 11.5.6+incompatible, 11.6.3+incompatible and more
- CVE-2026-5139GitLab Plugin Allows Non-Admin Users to Modify Default Instance ConfigurationGo · github.com/mattermost/mattermost-server · fixed in 10.11.18+incompatible, 11.5.6+incompatible, 11.6.3+incompatible and more
- CVE-2026-10561Unauthenticated Remote Code Execution in Langflow OSS PythonREPLComponent via Builtins InjectionPyPI · langflow · fixed in 1.10.1
- CVE-2026-9029Stored XSS in the Geomap panel tile-layer attributionGo · github.com/grafana/grafana · fixed in 1.9.2-0.20260616075434-82ef13993059
- CVE-2026-10601Path traversal in the Tempo and Loki data source pluginsGo · github.com/grafana/grafana · fixed in 1.9.2-0.20260616075434-82ef13993059
- CVE-2026-42129Path traversal in the Loki data source pluginGo · github.com/grafana/grafana · fixed in 1.9.2-0.20260616075434-82ef13993059
- CVE-2025-62198Apache Atlas: Stored XSS in Create Entity pageMaven · org.apache.atlas:atlas-dashboardv2 · fixed in 2.5.0
- CVE-2026-44914Apache NiFi: Missing Authorization of Restricted Permissions when Replacing Flow ContentsMaven · org.apache.nifi:nifi-web-api · fixed in 2.9.0
- CVE-2026-44911Apache NiFi: Incorrect Authorization for Configuration Verification RequestsMaven · org.apache.nifi:nifi-web-api · fixed in 2.10.0
- CVE-2026-44913Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQLMaven · org.apache.nifi:nifi-cdc-mysql-processors · fixed in 2.10.0
- CVE-2026-54665Apache NiFi: Missing Validation for Proxy Host HeadersMaven · org.apache.nifi:nifi-jetty · fixed in 2.10.0
- CVE-2025-66336Apache Doris MCP Server: SQL injection leading the authentication bypassPyPI · doris-mcp-server · fixed in 0.6.1
- CVE-2026-11748A vulnerability has been identified in centraldogma-server-auth-shiro versions prior to 0.84.0, where the SearchFirstActiveDirectoryRealm suMaven · com.linecorp.centraldogma:centraldogma-server-auth-shiro · fixed in 0.84.0
- CVE-2026-11746A vulnerability has been identified in centraldogma-server versions prior to 0.84.0, where enabling ZooKeeper replication without setting reMaven · com.linecorp.centraldogma:centraldogma-server · fixed in 0.84.0
- CVE-2026-11745A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verMaven · com.linecorp.centraldogma:centraldogma-server-mirror-git · fixed in 0.84.0
- CVE-2026-56397SiYuan - Remote Code Execution via Malicious Bazaar Package Metadata and READMEGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260317012524-fe4523fff2c8
- CVE-2026-56396phpMyFAQ - Privilege Escalation via Missing Authorization in editUser() and updateUserRights()Packagist · phpmyfaq/phpmyfaq, thorsten/phpmyfaq · fixed in 4.1.4