Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-34754MantisBT allows unauthorized users to upload attachments to restricted issues via REST APIPackagist · mantisbt/mantisbt · fixed in 2.28.2
- CVE-2026-34744MantisBT authorization bypass allows continued access to self-uploaded attachments on private issuesPackagist · mantisbt/mantisbt · fixed in 2.28.2
- CVE-2026-8495Date iCal - Critical - Information disclosure - SA-CONTRIB-2026-037Packagist · drupal/date_ical · fixed in 4.0.15
- CVE-2026-8493Colorbox Inline - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-036Packagist · drupal/colorbox_inline · fixed in 2.1.1
- CVE-2026-8492Translate Drupal with GTranslate - Less critical - DOM clobbering / link manipulation - SA-CONTRIB-2026-035Packagist · drupal/gtranslate · fixed in 3.0.5
- CVE-2026-8491Node View Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-034Packagist · drupal/node_view_permissions · fixed in 1.7.0, 2.0.1
- CVE-2026-6871Obfuscate - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-033Packagist · drupal/obfuscate · fixed in 2.0.2
- CVE-2026-6367Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003Packagist · drupal/core · fixed in 11.3.7
- CVE-2026-6366Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002Packagist · drupal/core · fixed in 10.5.9, 10.6.7, 11.2.11 and more
- CVE-2026-6365Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001Packagist · drupal/core · fixed in 10.5.9, 10.6.7, 11.2.11 and more
- CVE-2026-6095Orejime - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-032Packagist · drupal/orejime · fixed in 2.0.16
- CVE-2026-34579MantisBT has an authorization bypass via private issue monitoringPackagist · mantisbt/mantisbt · fixed in 2.28.2
- CVE-2026-34463MantisBT has Stored HTML Injection/XSS via Clone Issue FormPackagist · mantisbt/mantisbt · fixed in 2.28.2
- CVE-2026-34390MantisBT: Privilege Escalation from Manager to AdministratorPackagist · mantisbt/mantisbt · fixed in 2.28.2
- CVE-2026-27173Apache Airflow CNCF Kubernetes provider: JWT Token Exposure in KubernetesExecutor Command-Line ArgumentsPyPI · apache-airflow-providers-cncf-kubernetes · fixed in 10.17.0
- CVE-2026-42526Apache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backendsPyPI · apache-airflow-providers-amazon · fixed in 9.28.0
- CVE-2026-33637Faraday: Protocol-relative URI objects still bypass host scoping (possible incomplete fix for GHSA-33mh-2634-fwr2)RubyGems · faraday · fixed in 2.14.2
- CVE-2026-6009Jaspersoft Library Deserialisation VulnerabilityMaven · net.sf.jasperreports:jasperreports · fixed in 7.0.7
- CVE-2026-2586An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console.Maven · org.glassfish.jsftemplating:jsftemplating, org.glassfish.main.admingui:console-common · fixed in 4.2.0, 8.0.2
- CVE-2026-2587A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gaMaven · org.glassfish.jsftemplating:jsftemplating, org.glassfish.main.admingui:admingui · fixed in 4.2.0, 8.0.2
- CVE-2026-47323Apache Camel: Camel-CXF Message Header Injection via Missing Inbound FilteringMaven · org.apache.camel:camel-cxf-rest · fixed in 4.14.6, 4.18.2
- CVE-2026-7860Possible information disclosure of environment variables in Vaadin Build Plugins via Failed Frontend BuildMaven · com.vaadin:flow-gradle-plugin, com.vaadin:flow-maven-plugin +1 · fixed in 24.9.18, 24.10.4, 25.0.12 and more
- CVE-2026-7571Keycloak: keycloak: access token disclosure and implicit flow bypass via forged client dataMaven · org.keycloak:keycloak-services · fixed in 26.6.2
- CVE-2026-7507Org.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeoverMaven · org.keycloak:keycloak-services · fixed in 26.6.2
- CVE-2026-7504Org.keycloak/keycloak-services: open redirect when using wildcard valid redirect uris in keycloakMaven · org.keycloak:keycloak-services · fixed in 26.6.2
- CVE-2026-37982Keycloak: org.keycloak.authentication: keycloak: unauthorized account takeover via webauthn token replayMaven · org.keycloak:keycloak-services · fixed in 26.6.2
- CVE-2026-37979Keycloak: keycloak: information disclosure via oidc token introspection endpoint audience bypassMaven · org.keycloak:keycloak-services · fixed in 26.6.2
- CVE-2026-37978Keycloak: org.keycloak.services: keycloak: information disclosure via evaluate-scopes admin apiMaven · org.keycloak:keycloak-services · fixed in 26.6.2
- CVE-2026-7307Keycloak: keycloak: denial of service via specially crafted saml inputMaven · org.keycloak:keycloak-saml-core · fixed in 26.6.2
- CVE-2026-37981Keycloak: org.keycloak.authorization: keycloak: information disclosure via broken access control in user lookup endpointMaven · org.keycloak:keycloak-services · fixed in 26.4.12, 26.6.2