Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-46480Flowise: Evaluator create+update mass-assignment allows cross-workspace evaluator takeovernpm · flowise · fixed in 3.1.2
- CVE-2026-46479Flowise: Evaluation create+update mass-assignment allows cross-workspace evaluation takeovernpm · flowise · fixed in 3.1.2
- CVE-2026-46478Flowise: DatasetRow create+update mass-assignment allows cross-workspace row takeovernpm · flowise · fixed in 3.1.2
- CVE-2026-46477Flowise: Dataset create+update mass-assignment allows cross-workspace dataset takeovernpm · flowise · fixed in 3.1.2
- CVE-2026-46476Flowise: CustomTemplate create+update mass-assignment allows cross-workspace template takeovernpm · flowise · fixed in 3.1.2
- CVE-2026-46475Flowise: Assistant create+update mass-assignment allows cross-workspace assistant takeovernpm · flowise · fixed in 3.1.2
- CVE-2026-46443Flowise: Credential Data Leaknpm · flowise · fixed in 3.1.2
- CVE-2026-46442Flowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escapenpm · flowise · fixed in 3.1.2
- CVE-2026-46441Flowise: Mass Assignment in Assistant Update Endpoint Allows Cross-Workspace Resource Reassignmentnpm · flowise · fixed in 3.1.2
- CVE-2026-11529designcomputer mysql-mcp-server mysql URI server.py read_resource sql injectionPyPI · mysql-mcp-server · fixed in 0.3.0
- CVE-2026-46440Flowise: Basic Auth Credentials Exposed via APInpm · flowise · fixed in 3.1.2
- CVE-2026-42863Flowise: Mass Assignment in Chatflow Update Endpoint Allows Cross-Workspace AgentFlow Reassignmentnpm · flowise · fixed in 3.1.2
- CVE-2026-42862Flowise: Mass Assignment in Tool Update Endpoint Allows Cross-Workspace Resource Reassignmentnpm · flowise · fixed in 3.1.2
- CVE-2026-42861Flowise: Mass Assignment in Variable Update Endpoint Allows Cross-Workspace Resource Reassignmentnpm · flowise · fixed in 3.1.2
- CVE-2026-46444Flowise: Vector Store No Permission Checksnpm · flowise · fixed in 3.1.2
- CVE-2026-48488phpMyFAQ has Weak Cryptography - SHA1 for Password HashingPackagist · phpmyfaq/phpmyfaq, thorsten/phpmyfaq · fixed in 4.1.4
- CVE-2026-49235Routinator crashes on specifically crafted RRDP XML filescrates.io · routinator · fixed in 0.15.2
- CVE-2026-49234Routinator crashes on specifically crafted ASN strings in the APIcrates.io · routinator · fixed in 0.15.2
- CVE-2026-49233Routinator cache path traversal using rogue rsync URIscrates.io · routinator · fixed in 0.15.2
- CVE-2026-47430Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViewsnpm · cordova-plugin-inappbrowser · fixed in 6.0.1
- CVE-2026-11500Weaviate Static API Key client.go validateConfig authorizationGo · github.com/weaviate/weaviate · fixed in 1.38.0-rc.0
- CVE-2026-11481yoanbernabeu grepai Postgres Embedding Cache chunker.go PostgresStore.LookupByContentHash weak hashGo · github.com/yoanbernabeu/grepai
- CVE-2026-11479yoanbernabeu grepai Qdrant Backend chunker.go weak hashGo · github.com/yoanbernabeu/grepai
- CVE-2026-11477hs-web hsweb-framework OAuth2 Client OAuth2Client.java OAuth2Client redirectMaven · org.hswebframework.web:hsweb-authorization-oauth2
- CVE-2026-11470hs-web hsweb-framework File Upload FileUploadProperties.java denied path traversalMaven · org.hswebframework.web:hsweb-system-file
- CVE-2026-11466zilliztech deep-searcher collection_router.py CollectionRouter.invoke access controlPyPI · deepsearcher
- CVE-2026-11465songquanpeng one-api Redemption Code Top-Up Endpoint redemption.go Redeem logic errorGo · github.com/songquanpeng/one-api
- CVE-2026-45409Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fixPyPI · idna · fixed in 3.15
- CVE-2026-45758Malicious code in guardrails-ai 0.10.1 (supply chain compromise)PyPI · guardrails-ai
- CVE-2026-45300async-http-client: Cookie header not stripped on cross-origin redirectMaven · org.asynchttpclient:async-http-client · fixed in 3.0.10, 2.15.0