Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-6826Concrete 9.5.0 and below has file usage disclosure via missing permission check in Usage controllerPackagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-47102LiteLLM < 1.83.10 Privilege Escalation via User UpdatePyPI · litellm · fixed in 1.83.10
- CVE-2026-47101LiteLLM < 1.83.14 Privilege Escalation via API Key GenerationPyPI · litellm · fixed in 1.83.14
- CVE-2026-8203Concrete CMS 9.5.0 and below has Stored XSS on the height parameterPackagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-8197Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration namePackagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-8350Concrete CMS 9.5.0 and below is vulnerable to missing authorization in the bulk_user_assignment.php which can lead to privilege escalation to Administrative GroupPackagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-8421Concrete CMS 9.5.0 and below is vulnerable to CSRF on install_package() with conditional token bypass leading to RCEPackagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-8428CSRF token is not validated in the core CMS update controller for Concrete CMS 9.5.0 and belowPackagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-8426Concrete CMS 9.5.0 and below is vulnerable to CSRF on prepare_remote_upgrade() leading to one-request RCE via package overwritePackagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-8140Concrete CMS 9.5.0 and below is vulnerable to CSRF on download() in the package install controllerPackagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-8417Concrete CMS 9.5.0 and below is vulnerable to CSRF in do_update() in the package update controllerPackagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-8135Concrete CMS 9.5.0 and below is vulnerable to RCE due to insecure deserialization occurring in the ExpressEntryList block controller.Packagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-8134Concrete CMS 9.5.0 and below is vulnerable to Authenticated RCE via Composer customTemplate Path Traversal leading to PHP File InclusionPackagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-48207Apache Fory: PyFory ReduceSerializer Incomplete Policy EnforcementPyPI · pyfory · fixed in 1.0.0
- CVE-2026-45760Apache Camel K: Camel K Cross-Namespace Build Deputy AttackGo · github.com/apache/camel-k, github.com/apache/camel-k/v2 · fixed in 2.8.1, 2.9.2, 2.10.1
- CVE-2026-4858Path traversal in integration action URL leading to arbitrary API execution via system admin’s auth token.Go · github.com/mattermost/mattermost-server · fixed in 11.6.1, 11.5.4, 11.4.5 and more
- CVE-2026-4055Insufficient permission validation on cross-team playbook run creationGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 8.0.0-20260320113102-f2b3d1c6a945
- CVE-2026-2734Authorization Bypass in SearchModelVersions in mlflow/mlflowPyPI · mlflow · fixed in 3.10.0
- CVE-2026-40092nimiq-keys: Unchecked Ed25519 signature length in TaggedPublicKey::verify causes remote node panic via DHTcrates.io · nimiq-keys
- CVE-2026-39960MantisBT is Vulnerable to Stored XSS through Custom Field Textarea ValuesPackagist · mantisbt/mantisbt · fixed in 2.28.2
- CVE-2026-39850Yii 2: Local file inclusion via view parameter name collisionPackagist · yiisoft/yii2 · fixed in 2.0.55
- CVE-2026-33137XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}Maven · org.xwiki.platform:xwiki-platform-rest-server · fixed in 16.10.17, 17.4.9, 17.10.3 and more
- CVE-2026-26028CryptPad: Sanitizer Bypass in Diffmarked.js Allows Arbitrary HTML Injection and Potential XSSnpm · cryptpad
- CVE-2026-23734XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slashMaven · org.xwiki.commons:xwiki-commons-classloader-api · fixed in 16.10.17, 17.4.9, 17.10.3 and more
- CVE-2026-9082Drupal core - Highly critical - SQL injection - SA-CORE-2026-004Packagist · drupal/core · fixed in 10.4.10, 10.5.10, 10.6.9 and more
- CVE-2026-47099TeleJSON < 6.0.0 DOM-based XSS via parse() Functionnpm · telejson · fixed in 6.0.0
- CVE-2026-9087Keycloak: cross-session email verification proof not bound to upstream identity in first-broker-loginMaven · org.keycloak:keycloak-services · fixed in 26.6.3
- CVE-2026-24425Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterfacePackagist · twig/twig · fixed in 3.26.0
- CVE-2026-30691Cross-Site Scripting (XSS) vulnerability in @cyntler/react-doc-viewer v1.17.1 allows remote attackers to execute arbitrary JavaScript via a npm · @cyntler/react-doc-viewer
- CVE-2026-34970MantisBT Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is RevokedPackagist · mantisbt/mantisbt · fixed in 2.28.2