Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-46643Snappy: Binary path is never shell-escaped due to an inverted is_executable checkPackagist · knplabs/knp-snappy · fixed in 1.7.1
- CVE-2026-10740Excessive memory allocation in s2n-quiccrates.io · s2n-quic · fixed in 1.82.0
- CVE-2026-11417OS Command Injection in NodejsFunction Bundling in aws-cdk-libnpm · aws-cdk-lib · fixed in 2.246.0
- CVE-2026-45062FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP FilesGo · github.com/dunglas/frankenphp · fixed in 1.12.3
- CVE-2026-50570Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruptionGo · github.com/fission/fission · fixed in 1.25.0
- CVE-2026-50569Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checksGo · github.com/fission/fission · fixed in 1.25.0
- CVE-2026-50568Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escapeGo · github.com/fission/fission · fixed in 1.25.0
- CVE-2026-50567Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directoryGo · github.com/fission/fission · fixed in 1.25.0
- CVE-2026-50566Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creationGo · github.com/fission/fission · fixed in 1.24.0
- CVE-2026-50565Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder containerGo · github.com/fission/fission · fixed in 1.24.0
- CVE-2026-50564Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escapeGo · github.com/fission/fission · fixed in 1.24.0
- CVE-2026-50563Fission Container Executor Function PodSpec Injection Leading to Node EscapeGo · github.com/fission/fission · fixed in 1.24.0
- CVE-2026-50545Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster TakeoverGo · github.com/fission/fission · fixed in 1.24.0
- CVE-2026-49824Fission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhookGo · github.com/fission/fission · fixed in 1.24.0
- CVE-2026-49823Fission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhookGo · github.com/fission/fission · fixed in 1.24.0
- CVE-2026-49822Fission: Cross-namespace event leakage via KubernetesWatchTrigger allows persistent tenant surveillanceGo · github.com/fission/fission · fixed in 1.24.0
- CVE-2026-49821Fission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltrationGo · github.com/fission/fission · fixed in 1.24.0
- CVE-2026-46618Fission builder accepts arbitrary buildcmd strings from Environment.spec.builder.command, allowing the builder pod to invoke arbitrary executablesGo · github.com/fission/fission · fixed in 1.23.0
- CVE-2026-46617Fission runtime pods automount the fission-fetcher service-account token into the user function container, granting function code namespace-wide secret / configmap readGo · github.com/fission/fission · fixed in 1.23.0
- CVE-2026-46612Fission StorageSvc /v1/archive endpoint exposes unauthenticated CRUD over all function archivesGo · github.com/fission/fission · fixed in 1.23.0
- CVE-2026-46614Fission router exposes /fission-function/<ns>/<name> on its public listener, allowing invocation of any function without an HTTPTriggerGo · github.com/fission/fission · fixed in 1.23.0
- CVE-2026-46609Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialogNuGet · umbraco.cms · fixed in 17.4.0
- CVE-2026-46616Umbraco.Cms: Open Redirect Vulnerability in Surface ControllersNuGet · umbraco.cms · fixed in 13.14.0, 17.4.0
- CVE-2026-46497SSRF via sitemap-derived URLs in Crawlee for PythonPyPI · crawlee · fixed in 1.7.0
- CVE-2026-48096OpenFGA: Cache-key delimiter injection in openfga/openfga shared-iterator and v2 iterator caches enables intra-store authorization-decision poisoningGo · github.com/openfga/openfga · fixed in 1.16.0
- CVE-2026-25700Apache Answer: AdminToken not invalidated after admin deactivationGo · github.com/apache/answer, github.com/apache/incubator-answer · fixed in 2.0.1
- CVE-2026-53470Migration-planner: getsourcedownloadurl missing organization checkGo · github.com/kubev2v/migration-planner · fixed in 0.13.5
- CVE-2026-53476Assisted-migration-agent: vddk tarball chained-symlink arbitrary file writeGo · github.com/kubev2v/assisted-migration-agent · fixed in 0.16.0
- CVE-2026-53475Assisted-migration-agent: tls verification disabled on all vcenter connectionsGo · github.com/kubev2v/assisted-migration-agent · fixed in 0.16.0
- CVE-2026-53471Migration-planner: agent api ignores jwt source_id claimGo · github.com/kubev2v/migration-planner · fixed in 0.13.5