Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-48126Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dirGo · github.com/xyproto/algernon · fixed in 1.17.8
- CVE-2026-46431Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: *Go · github.com/xyproto/algernon · fixed in 1.17.7
- CVE-2026-46430Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOSGo · github.com/xyproto/algernon · fixed in 1.17.7
- CVE-2026-45728Algernon: Single-file mode unconditionally enables debug modeGo · github.com/xyproto/algernon · fixed in 1.17.7
- CVE-2026-45721Algernon: handler.lua discovery walks parent directories above the server rootGo · github.com/xyproto/algernon · fixed in 1.17.7
- CVE-2026-47716Bugsink: Issue bulk actions can affect another project’s issue if its UUID is knownPyPI · bugsink · fixed in 2.2.0
- CVE-2026-47715Bugsink: Issue event views can show an event from another project if its UUID is knownPyPI · bugsink · fixed in 2.2.0
- CVE-2026-47728Bugsink: Project scoping missing in sourcemap and debug-file lookupPyPI · bugsink · fixed in 2.2.0
- CVE-2026-44502Bugsink: SSRF bypass in `validate_webhook_url`PyPI · bugsink · fixed in 2.1.3
- CVE-2026-40034gitoxide - Command Injection via Partial .gitmodules Override in gix-submodulecrates.io · gix · fixed in 0.83.0
- CVE-2026-7374Kubevirt: kubevirt virt-handler: privilege escalation and node compromise via symlink following vulnerabilityGo · kubevirt.io/kubevirt · fixed in 1.6.6, 1.7.4, 1.8.3
- CVE-2026-9540vllm-project vllm OpenAI-compatible Serving Path denial of servicePyPI · vllm
- CVE-2026-9496Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function.npm · pacote · fixed in 21.5.1
- CVE-2026-9495Versions of the package @koa/router from 14.0.0 and before 15.0.0 are vulnerable to Access Control Bypass due to the middleware being silentnpm · @koa/router · fixed in 15.0.0
- CVE-2026-9520blitz-js blitz Sign-in LoginForm.tsx cross site scriptingnpm · blitz
- CVE-2026-48589Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flowMaven · org.apache.shiro:shiro-jakarta-ee · fixed in 2.2.1, 3.0.0-alpha-2
- CVE-2026-44598Apache Shiro Jakarta EE module: Open redirect and SSRF (requires valid credentials)Maven · org.apache.shiro:shiro-jakarta-ee · fixed in 2.2.0, 3.0.0-alpha-2
- CVE-2026-43828Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by defaultMaven · org.apache.shiro:shiro-web · fixed in 2.2.0, 3.0.0-alpha-2
- CVE-2026-43827Apache Shiro: Session fixation: new session is not created after login by defaultMaven · org.apache.shiro:shiro-core · fixed in 2.2.0, 3.0.0-alpha-2
- CVE-2026-9497changmingxie tcc-transaction Fastjson AutoType REST API Fastjson.parseObject deserializationMaven · org.mengyun:tcc-transaction
- CVE-2026-42797Apache Syncope: JexlContextBuilder Information DisclosureMaven · org.apache.syncope.core:syncope-core-provisioning-api · fixed in 4.0.6, 4.1.1
- CVE-2026-42782Apache Syncope: Post-auth RCE via Groovy staticMaven · org.apache.syncope.core:syncope-core-spring · fixed in 4.0.6, 4.1.1
- CVE-2026-46745Apache Airflow FAB provider: LDAP Filter Injection in FAB Auth Manager _search_ldap reachable via /auth/tokenPyPI · apache-airflow-providers-fab · fixed in 3.6.4
- CVE-2026-45361Apache Airflow Google provider: SSH host key verification disabled in ComputeEngineSSHHook (paramiko AutoAddPolicy default)PyPI · apache-airflow-providers-google · fixed in 22.0.0
- CVE-2026-5223Crates in third party registries can override the cached source of other cratescrates.io · cargo · fixed in 0.97.0
- CVE-2026-5222Cargo can be coerced to share credentials between registriescrates.io · cargo · fixed in 0.97.0
- CVE-2026-45249Apache ECharts: XSS in Lines series tooltip renderingnpm · echarts · fixed in 6.1.0
- CVE-2026-4915Server panic via outgoing webhook responsesGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 11.6.1, 11.5.4, 11.4.5 and more
- CVE-2026-2651Missing Authorization Validation in mlflow/mlflowPyPI · mlflow · fixed in 3.11.0rc0, 3.10.0
- CVE-2026-41863LLM-influenced filename used unsanitized in Path.resolve before file write in Spring AI support for Anthropic Skills APIMaven · org.springframework.ai:spring-ai-anthropic · fixed in 1.1.7