Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-4372Arbitrary Remote Code Execution via `_attn_implementation_internal` Config Injection in huggingface/transformersPyPI · transformers · fixed in 5.3.0
- CVE-2026-9370ulisesbocchio jasypt-spring-boot Password Hash SimpleGCMConfig.java getSecretKeySaltGenerator hash predictable saltMaven · com.github.ulisesbocchio:jasypt-spring-boot, com.github.ulisesbocchio:jasypt-spring-boot-starter
- CVE-2026-9369NousResearch hermes-agent CLI web-dashboard web_server.py _discover_dashboard_plugins comparisonPyPI · hermes-agent · fixed in 0.15.0
- CVE-2026-9368NousResearch hermes-agent Environment Variable code_execution_tool.py execute_code sandboxPyPI · hermes-agent · fixed in 0.11.0
- CVE-2026-9366NousResearch hermes-agent prompt_builder.py _scan_context_content injectionPyPI · hermes-agent · fixed in 0.15.0
- CVE-2026-9358postcss-selector-parser AST Serialization container.js toString recursionnpm · postcss-selector-parser · fixed in 6.1.3, 7.1.3
- CVE-2026-9353NousResearch hermes-agent Skills Guard Multi-Word Prompt skills_guard.py injectionPyPI · hermes-agent · fixed in 0.15.0
- CVE-2026-3515Argument Injection in prefecthq/prefectPyPI · prefect
- CVE-2018-25357Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.phpPackagist · dolibarr/dolibarr · fixed in 7.0.4, 6.0.8
- CVE-2026-9301omec-project amf NGReset Message memory corruptionGo · github.com/omec-project/amf · fixed in 1.7.1-0.20260421213846-34bc6724acc9
- CVE-2026-9300omec-project amf NGSetupRequest memory corruptionGo · github.com/omec-project/amf · fixed in 1.7.1-0.20260421213846-34bc6724acc9
- CVE-2026-9299omec-project amf handler.go PDUSessionResourceModifyIndication memory corruptionGo · github.com/omec-project/amf · fixed in 1.7.1-0.20260421213846-34bc6724acc9
- CVE-2026-41149Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injectionnpm · mermaid · fixed in 11.15.0, 10.9.6
- CVE-2026-41148Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injectionnpm · mermaid · fixed in 11.15.0, 10.9.6
- CVE-2026-41147NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request classPackagist · nukeviet/nukeviet
- CVE-2026-40864JupyterHub: Cross-origin form POSTs bypass XSRFPyPI · jupyterhub · fixed in 5.4.5
- CVE-2026-40610BentoML has Information Disclosure in `bentoml build` via symlink traversal in the build contextPyPI · bentoml · fixed in 1.4.39
- CVE-2026-39824Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windowsGo · golang.org/x/sys · fixed in 0.44.0
- CVE-2026-40607MantisBT is Vulnerable to Stored XSS Through its Saved-Filter Owner ColumnPackagist · mantisbt/mantisbt · fixed in 2.28.2
- CVE-2026-40598MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update PagePackagist · mantisbt/mantisbt · fixed in 2.28.2
- CVE-2026-40597MantisBT has a Content Security Policy bypass via attachmentsPackagist · mantisbt/mantisbt · fixed in 2.28.2
- CVE-2026-40596MantisBT is vulnerable to XSS and potential account takeover via user font family preference updatePackagist · mantisbt/mantisbt · fixed in 2.28.2
- CVE-2026-40295Devise: Open Redirect via Unvalidated `request.referrer` in Timeoutable Session Timeout HandlerRubyGems · devise · fixed in 5.0.4
- CVE-2026-9291Insecure Deserialization in Amazon Braket SDK Job Results ProcessingPyPI · amazon-braket-sdk · fixed in 1.117.0
- CVE-2026-39964TypeBot: Stored XSS via javascript: URI in text bubble links — bot author executes JS on visitors' browsersnpm · @typebot.io/js · fixed in 0.10.1
- CVE-2026-28735GitHub OAuth Scope ValidationGo · github.com/mattermost/mattermost-plugin-github, github.com/mattermost/mattermost-server · fixed in 1.0.1-0.20260318132218-6e6b740c4852, 11.6.1, 11.5.4 and more
- CVE-2026-28445Typebot: Stored XSS via Rating Block Custom Icon Bypasses isUnsafe Sandbox in Builder Previewnpm · @typebot.io/js · fixed in 0.10.1
- CVE-2026-27136Invoking duplicate attributes can cause XSS in golang.org/x/net/htmlGo · golang.org/x/net · fixed in 0.55.0
- CVE-2026-25681Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/htmlGo · golang.org/x/net · fixed in 0.55.0
- CVE-2026-25680Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/htmlGo · golang.org/x/net · fixed in 0.55.0