Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-49270Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Durable Subscription Disclosure via Crafted BrokerInfo (OpenWire)Maven · org.apache.activemq:activemq-all, org.apache.activemq:activemq-broker +1 · fixed in 5.19.7, 6.2.6
- CVE-2026-35563Apache Directory LDAP API: LDAP client implementation does not verify if the server certificate matches the intended LDAP hostnameMaven · org.apache.directory.api:api-ldap-client-api · fixed in 2.1.8
- CVE-2026-45192Apache Airflow: Incomplete Redaction of Sensitive Fields in Connection Extra API ResponsePyPI · apache-airflow, apache-airflow-core · fixed in 3.0.0, 3.2.2
- CVE-2026-10224NousResearch hermes-agent Webhook Endpoint feishu.py _handle_webhook_request resource consumptionPyPI · hermes-agent
- CVE-2026-10223NousResearch hermes-agent memory_tool.py _scan_memory_content injectionPyPI · hermes-agent · fixed in 0.15.0
- CVE-2026-10222NousResearch hermes-agent config.py _sanitize_env_lines injectionPyPI · hermes-agent · fixed in 0.18.0
- CVE-2026-10221NousResearch hermes-agent run_agent.py _compress_context injectionPyPI · hermes-agent
- CVE-2026-10219nextlevelbuilder GoClaw write_file Tool fsbridge.go FsBridge.WriteFile os command injectionGo · github.com/nextlevelbuilder/goclaw
- CVE-2026-10215Dolibarr ERP CRM Leave Request REST API api_holidays.class.php checkUserAccessToObject improper authorizationPackagist · dolibarr/dolibarr
- CVE-2026-10212AstrBotDevs AstrBot astr_main_agent.py astr_main_agent authorizationPyPI · astrbot
- CVE-2026-10177Aider-AI Aider AWS EC2 Metadata Endpoint api_docs.py requests.get server-side request forgeryPyPI · aider-chat
- CVE-2026-10175Aider-AI Aider Architect Mode auth.py editor_coder.run code injectionPyPI · aider-chat
- CVE-2026-46385iskorotkov/avro: CPU Exhaustion in Avro DecoderGo · github.com/hamba/avro/v2, github.com/iskorotkov/avro/v2 · fixed in 2.33.0
- CVE-2026-46384iskorotkov/avro: Integer Overflow in Avro DecoderGo · github.com/hamba/avro/v2, github.com/iskorotkov/avro/v2 · fixed in 2.33.0
- CVE-2026-45149brace-expansion: Large numeric range defeats documented `max` DoS protectionnpm · brace-expansion · fixed in 5.0.6
- CVE-2026-48557Spatie Laravel Media Library < 11.23.0 File Upload Restriction Bypass via FileAdder.phpPackagist · spatie/laravel-medialibrary · fixed in 11.23.0
- CVE-2026-46599Excessive resource consumption in PackBits decompression in golang.org/x/image/tiffGo · golang.org/x/image · fixed in 0.41.0
- CVE-2026-47266Formie: Unauthenticated front-end submission editing can overwrite existing submissionsPackagist · verbb/formie · fixed in 3.1.26, 2.2.21
- CVE-2026-45697Formie: Pre-authenticated server-side template injection in Hidden fieldsPackagist · verbb/formie · fixed in 3.1.24, 2.2.20
- CVE-2026-42500Panic when reading out of bound palette index in golang.org/x/image/bmpGo · golang.org/x/image · fixed in 0.41.0
- CVE-2026-48555Spatie Laravel Media Library < 11.23.0 SSRF via addMediaFromUrl()Packagist · spatie/laravel-medialibrary · fixed in 11.23.0
- CVE-2026-47740Shopper: Authorization bypass in multiple Livewire admin componentsPackagist · shopper/framework · fixed in 2.8.0
- CVE-2026-47741Shopper: Race condition on Discount.usage_limit allows silent over-redemptionPackagist · shopper/cart · fixed in 2.8.0
- CVE-2026-47742Shopper: Missing authorization on Product admin Livewire sub-form componentsPackagist · shopper/framework · fixed in 2.8.0
- CVE-2026-47744Shopper: Authorization bypass and RBAC privilege escalation in team settingsPackagist · shopper/framework · fixed in 2.8.0
- CVE-2026-47745Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tablesPackagist · shopper/framework · fixed in 2.8.0
- CVE-2026-44651SillyTavern: Reflected XSS vulnerability in the CORS proxy middlewarenpm · sillytavern · fixed in 1.18.0
- CVE-2026-44650SillyTavern: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')npm · sillytavern · fixed in 1.18.0
- CVE-2026-44648SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeovernpm · sillytavern · fixed in 1.18.0
- CVE-2026-44649SillyTavern: Authentication Bypass via SSO Header Injectionnpm · sillytavern · fixed in 1.18.0