Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-45288Marten has an SQL injection vulnerability in its full-text search regConfig parameterNuGet · marten · fixed in 8.37.0
- CVE-2026-45332Automad Broken Access Control: unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpointPackagist · automad/automad · fixed in 2.0.0-beta.28
- CVE-2026-43979Local Deep Research: HTML Injection via Unescaped User Input in PDF Export (`pdf_service.py:_markdown_to_html`)PyPI · local-deep-research · fixed in 1.6.0
- CVE-2026-46526Local Deep Research: SSRF bypass in `safe_get`PyPI · local-deep-research · fixed in 1.6.10
- CVE-2026-46509deepobj: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')npm · @ranfdev/deepobj · fixed in 1.0.3
- CVE-2026-43898SandboxJS: Sandbox escape via Function.caller leakage of internal call opnpm · @nyariv/sandboxjs · fixed in 0.9.6
- CVE-2026-45021Kuma: Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdminGo · github.com/kumahq/kuma, github.com/kumahq/kuma/v2 · fixed in 2.7.25, 2.9.15, 2.11.13 and more
- CVE-2026-45311CodeWhale: run_tests Tool Enables RCE via Malicious Repository Without Approvalnpm · deepseek-tui · fixed in 0.8.23
- CVE-2026-45310CodeWhale: SSRF via HTTP Redirect Bypass in fetch_url Toolnpm · deepseek-tui · fixed in 0.8.22
- CVE-2026-45373CodeWhale: SSRF IPV6 bypasscrates.io · deepseek-tui · fixed in 0.8.26
- CVE-2026-45374CodeWhale: task_create Insecure Defaults Enable RCE via Prompt Injection in Project Filescrates.io · deepseek-tui · fixed in 0.8.26
- CVE-2026-45058electerm: Import unsafe bookmark data could lead to unsafe operation when click local type bookmarknpm · electerm
- CVE-2026-45353electerm: Local code through electerm's single-instance socketnpm · electerm · fixed in 3.9.0
- CVE-2026-45787electerm's encrypt method not safe enoughnpm · electerm · fixed in 3.9.5
- CVE-2026-45306pyLoad: Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session DirectoryPyPI · pyload-ng
- CVE-2026-45348pyLoad: Stored XSS in Downloads view via unsanitized link URL in packages.js template literalPyPI · pyload-ng
- CVE-2026-46561pyLoad: SSRF via HTTP Redirect Bypass in parse_urls APIPyPI · pyload-ng · fixed in 0.5.0b3.dev100
- CVE-2026-44794Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to referencePyPI · nautobot · fixed in 2.4.33, 3.1.2
- CVE-2026-44796Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)PyPI · nautobot · fixed in 3.1.2, 2.4.33
- CVE-2026-44797Nautobot: Webhook definitions could be used for server-side request forgery (SSRF)PyPI · nautobot · fixed in 3.1.2, 2.4.33
- CVE-2026-44798Nautobot: GitRepository.current_head field should not be writable through REST APIPyPI · nautobot · fixed in 3.1.2, 2.4.33
- CVE-2026-44543Local Path Provisioner: HelperPod Template InjectionGo · github.com/rancher/local-path-provisioner · fixed in 0.0.36
- CVE-2026-45292opentelemetry-java: Unbounded Memory Allocation in W3C Baggage PropagationMaven · io.opentelemetry:opentelemetry-api, io.opentelemetry:opentelemetry-extension-trace-propagators · fixed in 1.62.0
- CVE-2026-9098CVE-2026-9098Go · github.com/casdoor/casdoor
- CVE-2026-9097CVE-2026-9097Go · github.com/casdoor/casdoor
- CVE-2026-9096CVE-2026-9096Go · github.com/casdoor/casdoor
- CVE-2026-9094CVE-2026-9094Go · github.com/casdoor/casdoor · fixed in 2.387.0
- CVE-2026-9093CVE-2026-9093Go · github.com/casdoor/casdoor
- CVE-2026-9091CVE-2026-9091Go · github.com/casdoor/casdoor
- CVE-2026-9090CVE-2026-9090Go · github.com/casdoor/casdoor