Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-5366Git Argument Injection in prefecthq/prefectPyPI · prefect · fixed in 3.6.25
- CVE-2026-56304picklescan - Arbitrary File Creation via logging.FileHandler DeserializationPyPI · picklescan · fixed in 1.0.1
- CVE-2026-56294capacitor-native-biometric - Authentication Bypass via Unvalidated CryptoObject in onAuthenticationSucceedednpm · @capgo/capacitor-native-biometric · fixed in 8.3.6
- CVE-2026-56276Flowise - Mass Assignment in PUT /api/v1/user Allows Password Hash Overridenpm · flowise · fixed in 3.1.2
- CVE-2026-56267Flowise - PII Disclosure via Unauthenticated Forgot Password Endpointnpm · flowise · fixed in 3.0.13
- CVE-2025-71331Flowise - Cross-Site Scripting in Chat Messages and Agent Workflowsnpm · flowise · fixed in 3.0.8
- CVE-2026-56317Nuxt - Cross-Site Scripting via NoScript Component Slot Contentnpm · nuxt · fixed in 4.4.7, 3.21.7
- CVE-2024-58351Flowise - Remote Code Execution via overrideConfig Parameternpm · flowise · fixed in 2.1.4
- CVE-2026-50559Authentication/Authorization Bypass via Advanced Path Normalization VulnerabilitiesMaven · io.quarkus:quarkus-vertx-http · fixed in 3.20.6.2, 3.27.4.1, 3.33.2.1 and more
- CVE-2026-48794Authelia has an Edge Case Access Control Rule MismatchGo · github.com/authelia/authelia, github.com/authelia/authelia/v4 · fixed in 4.39.20
- CVE-2026-47203Authelia Missing Username Canonicalization in Basic Auth (LDAP)Go · github.com/authelia/authelia, github.com/authelia/authelia/v4 · fixed in 4.39.20
- CVE-2026-48089DevGuard has improper authorization on public assetsGo · github.com/l3montree-dev/devguard · fixed in 1.4.2
- CVE-2026-49342YARD static cache reads raw traversal paths before router sanitizationRubyGems · yard · fixed in 0.9.44
- CVE-2026-49340gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the hostGo · go.senan.xyz/gonic · fixed in 0.21.0
- CVE-2026-49338Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR)Go · go.senan.xyz/gonic · fixed in 0.21.0
- CVE-2026-27878Tempo TraceQL query with exemplar hint could result in unbounded memory usageGo · github.com/grafana/tempo · fixed in 1.5.1-0.20260303204923-b13f74291d48
- CVE-2026-49339Path traversal in getPlaylist/deletePlaylist bypasses ownership check: any authenticated user can read or delete any other user's playlistGo · go.senan.xyz/gonic · fixed in 0.21.0
- CVE-2026-49336@microsoft/kiota-http-fetchlibrary: Bearer token and Cookie leak across origin on redirect due to case-mismatched scrub in fetchRequestAdapternpm · @microsoft/kiota-http-fetchlibrary · fixed in 1.0.0-preview.102
- CVE-2026-49293CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literalsnpm · js-toml · fixed in 1.1.2
- CVE-2026-49288Statamic CMS missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resourcesPackagist · statamic/cms · fixed in 5.73.23, 6.20.0
- CVE-2026-49291mcp-memory-service: OAuth read-only clients can write and delete memories through MCP tools/callPyPI · mcp-memory-service · fixed in 10.65.3
- CVE-2026-49287Statamic CMS vulnerable to unsafe method invocation via collection sorting allows data destructionPackagist · statamic/cms · fixed in 5.73.23, 6.20.0
- CVE-2026-49359PhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment optionPackagist · pontedilana/php-weasyprint · fixed in 2.6.0
- CVE-2026-49286PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)Packagist · pontedilana/php-weasyprint · fixed in 2.6.0
- CVE-2026-49260PhpWeasyPrint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc)Packagist · pontedilana/php-weasyprint · fixed in 2.5.1
- CVE-2026-49358PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFilesPackagist · pontedilana/php-weasyprint · fixed in 2.6.0
- CVE-2026-49357Streamable HTTP mode exposes LINE Desktop read/send tools without MCP authenticationnpm · line-desktop-mcp · fixed in 1.1.2
- CVE-2026-44939Command injection through unsanitized YAML parameter in RancherGo · github.com/rancher/rancher · fixed in 2.14.2, 2.13.6, 2.12.10 and more
- CVE-2026-11941Use-after-free in connection ID iterator and FFI functionscrates.io · quiche · fixed in 0.29.2
- CVE-2026-12644Versions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.protonpm · ts-deepmerge · fixed in 8.0.0