Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-4630Keycloak: keycloak: unauthorized resource access and data modification via insecure direct object referenceMaven · org.keycloak:keycloak-services · fixed in 26.6.2
- CVE-2026-46725Remote Code Execution in extension "Content Element Selector" (ceselector)Packagist · mmc/ceselector · fixed in 6.0.1, 5.0.1, 4.0.2 and more
- CVE-2026-8827SQL Injection in extension "Address List" (tt_address)Packagist · friendsoftypo3/tt-address · fixed in 10.0.1, 9.1.1, 8.1.2
- CVE-2026-46724Path Traversal in extension "Faceted Search" (ke_search)Packagist · tpwd/ke_search · fixed in 7.0.1, 6.6.1, 5.6.2 and more
- CVE-2026-46723Information Disclosure in extension "Faceted Search" (ke_search)Packagist · tpwd/ke_search · fixed in 7.0.1, 6.6.1, 5.6.2 and more
- CVE-2026-46722XML External Entity Injection in extension "Faceted Search" (ke_search)Packagist · tpwd/ke_search · fixed in 7.0.1, 6.6.1, 5.6.2 and more
- CVE-2026-8726SQL Injection in extension "News system" (news)Packagist · georgringer/news · fixed in 12.3.2, 13.0.2, 14.0.3 and more
- CVE-2026-46721Broken Access Control in extension "Frontend User Registration" (sf_register)Packagist · evoweb/sf-register · fixed in 14.0.2, 13.2.4
- CVE-2026-2611Improper Origin Validation in mlflow/mlflowPyPI · mlflow · fixed in 3.10.0
- CVE-2026-8727Remote Code Execution in extension "Site Crawler" (crawler)Packagist · tomasnorre/crawler · fixed in 12.0.11, 11.0.13
- CVE-2026-8922Org.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: security flaw in org.keycloak/keycloak-servicesMaven · org.keycloak:keycloak-services
- CVE-2026-8830Keycloak: org.keycloak/keycloak-services: keycloak: policy bypass during webauthn credential registration via client-side javascript manipulationMaven · org.keycloak:keycloak-services · fixed in 26.6.3
- CVE-2026-8814Versions of the package exifreader before 4.39.0 are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) due to dnpm · exifreader · fixed in 4.39.0
- CVE-2026-8813This affects versions of the package exifreader before 4.39.0.npm · exifreader · fixed in 4.39.0
- CVE-2026-33052MantisBT: Authorization Bypass in Global Profile CreationPackagist · mantisbt/mantisbt · fixed in 2.28.2
- CVE-2025-51427An issue was discovered in ModelScope 1.25.0 allowing attackers to execute arbitrary code via crafted module listed in the configuration filPyPI · modelscope · fixed in 1.27.0
- CVE-2025-70950An issue in gohttp commit 34ea51 allows attackers to execute a directory traversal via supplying a crafted request.Go · github.com/itang/gohttp
- CVE-2026-31069BillaBear (all versions prior to Jan 2026) contains a SQL Injection vulnerability in the EventRepository.Packagist · billabear/billabear
- CVE-2026-31072The JSONSerializer and CBORSerializer in APScheduler (all versions including 3.10.x and 4.0.0a5) are vulnerable to Remote Code Execution…PyPI · apscheduler
- CVE-2026-27964FacturaScripts: Reflected Cross-Site Scripting (XSS) via Cookie ManipulationPackagist · facturascripts/facturascripts · fixed in 2025.8, 2025.81
- CVE-2026-27892FacturaScripts: Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/DownloadPackagist · facturascripts/facturascripts · fixed in 2026
- CVE-2026-27891Remote Code Execution (RCE) via Zip Slip in Plugin Upload MechanismPackagist · facturascripts/facturascripts
- CVE-2026-25244WebdriverIO has Command Injection in the BrowserStack Servicenpm · @wdio/browserstack-service · fixed in 9.24.0
- CVE-2026-4137Incomplete Fix for CVE-2025-10279: Insecure Temporary Directory Permissions in mlflow/mlflowPyPI · mlflow · fixed in 3.11.0
- CVE-2026-22810Joplin: Path traversal in OneNote importer allows overwriting arbitrary filesnpm · @joplin/onenote-converter · fixed in 3.5.7
- CVE-2026-8838Remote Code Execution via eval() Injection in amazon-redshift-python-driverPyPI · redshift-connector · fixed in 2.1.14
- CVE-2025-65954SimpleSAMLphp-casserver has an Open Redirect vulnerability via logoutPackagist · simplesamlphp/simplesamlphp-module-casserver · fixed in 7.0.0, 6.3.1
- CVE-2026-45245Summarize < 0.15.1 Unauthorized Daemon Request via Untrusted Eventsnpm · @steipete/summarize · fixed in 0.15.1
- CVE-2026-45244Summarize < 0.15.1 Unapproved Browser Automation Executionnpm · @steipete/summarize · fixed in 0.15.0
- CVE-2026-45242Summarize < 0.15.1 Path Traversal via slidesDir Parameternpm · @steipete/summarize · fixed in 0.15.0