Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-45731WWBN AVideo: Authenticated Arbitrary File Read in view/update.phpPackagist · wwbn/avideo
- CVE-2026-46337WWBN AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php`Packagist · wwbn/avideo
- CVE-2026-47694WWBN AVideo: Stored XSS via unescaped Gallery category descriptionPackagist · wwbn/avideo
- CVE-2026-47696WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpointPackagist · wwbn/avideo
- CVE-2026-48527HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpointnpm · @haxtheweb/haxcms-nodejs · fixed in 26.0.1
- CVE-2026-9811A stored Cross-Site Scripting (XSS) vulnerability exists in the project selector component of Mautic 7.Packagist · mautic/core · fixed in 7.1.2
- CVE-2026-9809A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7.Packagist · mautic/core · fixed in 7.1.2
- CVE-2026-9808An authorization bypass vulnerability exists in the Mautic 7 API v2 endpoints (utilizing API Platform).Packagist · mautic/core · fixed in 7.1.2
- CVE-2026-9559A path traversal vulnerability exists in the campaign import feature of Mautic 7.Packagist · mautic/core · fixed in 7.1.2
- CVE-2026-9558A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine.Packagist · mautic/core · fixed in 5.2.11, 6.0.9, 7.1.2
- CVE-2026-9557A Server-Side Request Forgery (SSRF) vulnerability exists in Mautic's Focus component.Packagist · mautic/core · fixed in 5.2.11, 6.0.9, 7.1.2
- CVE-2026-4776An SQL injection vulnerability exists in Mautic's API contact filtering mechanism.Packagist · mautic/core · fixed in 5.2.11, 6.0.9, 7.1.2
- CVE-2026-5343SAML SSO - Service Provider - Critical - Authentication bypass - SA-CONTRIB-2026-031Packagist · drupal/miniorange_saml · fixed in 3.1.4
- CVE-2026-49299In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write operations while the defiPyPI · neutron · fixed in 26.0.4, 27.0.3, 28.0.1
- CVE-2026-45364Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotationnpm · better-auth · fixed in 1.4.17, 1.5.0-beta.9
- CVE-2026-44973Billy: Path traversal vulnerabilitiesGo · github.com/go-git/go-billy/v5, github.com/go-git/go-billy/v6 · fixed in 5.9.0, 6.0.0-alpha.1
- CVE-2026-44881Portainer: Arbitrary File Read via Git Symlink Injection in Stack Auto-UpdateGo · github.com/portainer/portainer · fixed in 2.33.8, 2.39.2, 2.41.0
- CVE-2026-44848Portainer: Missing authorization on Docker plugin endpoints allows host RCEGo · github.com/portainer/portainer · fixed in 2.33.8, 2.39.2, 2.41.0
- CVE-2026-44849Portainer: Endpoint security bypass via Swarm service create/updateGo · github.com/portainer/portainer · fixed in 2.33.8, 2.39.2, 2.41.0
- CVE-2026-44850Portainer: Bind-mount restriction bypass via HostConfig.MountsGo · github.com/portainer/portainer · fixed in 2.33.8, 2.39.2, 2.41.0
- CVE-2026-44882Portainer: Kubernetes middleware continues after token validation failure, bypassing endpoint authorizationGo · github.com/portainer/portainer · fixed in 2.33.8
- CVE-2026-44883Portainer: JWT accepted in URL query leaks tokens to logs and referersGo · github.com/portainer/portainer · fixed in 2.33.8, 2.39.2, 2.41.0
- CVE-2026-44884Portainer: Missing authorization on custom template file endpoint exposes template contentGo · github.com/portainer/portainer · fixed in 2.33.8, 2.39.1
- CVE-2026-44885Portainer: Path traversal in backup archive extraction allows arbitrary file writeGo · github.com/portainer/portainer · fixed in 2.33.8
- CVE-2026-45366typescript-utcp: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocolnpm · @utcp/http · fixed in 1.1.2
- CVE-2026-42071MantisBT: Private Bugnote Attachment Content Leak via REST APIPackagist · mantisbt/mantisbt · fixed in 2.28.2
- CVE-2026-42070MantisBT: Authorization Bypass in Bugnote Editing via Issue Update APIPackagist · mantisbt/mantisbt · fixed in 2.28.2
- CVE-2026-44655MantisBT: Stored XSS on Move Attachments Admin PagePackagist · mantisbt/mantisbt · fixed in 2.28.2
- CVE-2026-41897MantisBT: Reflected XSS in Rendering Dynamic Custom Textarea FieldPackagist · mantisbt/mantisbt · fixed in 2.28.2
- CVE-2026-44657MantisBT: Stored XSS in File DownloadPackagist · mantisbt/mantisbt · fixed in 2.28.2