Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-45399Open WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing system-wide chat disruptionPyPI · open-webui · fixed in 0.9.0
- CVE-2026-45671Open WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletionPyPI · open-webui · fixed in 0.9.0
- CVE-2026-45675Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin AccountsPyPI · open-webui · fixed in 0.9.0
- CVE-2026-4053post edit time limit is not enforced on some post update operationsGo · github.com/mattermost/mattermost-server · fixed in 0.0.0-20260414103857-b21ef302025e, 11.5.2+incompatible, 11.5.2
- CVE-2026-46367phpMyFAQ - Stored XSS via Utils::parseUrl() in Comment RenderingPackagist · phpmyfaq/phpmyfaq, thorsten/phpmyfaq · fixed in 4.1.2
- CVE-2026-46366phpMyFAQ - Unauthenticated Information Disclosure via getIdFromSolutionId Permission BypassPackagist · phpmyfaq/phpmyfaq, thorsten/phpmyfaq · fixed in 4.1.2
- CVE-2026-46365phpMyFAQ - Missing Authorization in Tag Deletion EndpointPackagist · phpmyfaq/phpmyfaq, thorsten/phpmyfaq · fixed in 4.1.2
- CVE-2026-46364phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptchaPackagist · phpmyfaq/phpmyfaq, thorsten/phpmyfaq · fixed in 4.1.2
- CVE-2026-46363phpMyFAQ - Stored XSS in FAQ Question/Answer via Encode-Decode BypassPackagist · phpmyfaq/phpmyfaq, thorsten/phpmyfaq · fixed in 4.1.2
- CVE-2026-46362phpMyFAQ - Authorization Bypass in Admin Pages via Non-Terminating Permission CheckPackagist · phpmyfaq/phpmyfaq, thorsten/phpmyfaq · fixed in 4.1.2
- CVE-2026-46361phpMyFAQ - Stored Cross-Site Scripting via raw Filter in search.twigPackagist · phpmyfaq/phpmyfaq, thorsten/phpmyfaq · fixed in 4.1.2
- CVE-2026-46360phpMyFAQ - Stored XSS via Entity Decoding Depth Limit Bypass in SVG SanitizerPackagist · phpmyfaq/phpmyfaq, thorsten/phpmyfaq · fixed in 4.1.2
- CVE-2026-46359phpMyFAQ - SQL Injection in CurrentUser::setTokenData via Unescaped OAuth Token FieldsPackagist · phpmyfaq/phpmyfaq, thorsten/phpmyfaq · fixed in 4.1.2
- CVE-2026-45010phpMyFAQ - Unauthenticated Two-Factor Authentication Brute-Force via /admin/check EndpointPackagist · phpmyfaq/phpmyfaq, thorsten/phpmyfaq · fixed in 4.1.2
- CVE-2026-45009phpMyFAQ - Insufficient Authorization Check in Admin API EndpointsPackagist · phpmyfaq/phpmyfaq, thorsten/phpmyfaq · fixed in 4.1.2
- CVE-2026-45008phpMyFAQ - Path Traversal in Client::deleteClientFolder via URL ParameterPackagist · phpmyfaq/phpmyfaq, thorsten/phpmyfaq · fixed in 4.1.2
- CVE-2026-45007phpMyFAQ - Missing Permission Check on 12 Configuration API Endpoints Allows Information DisclosurePackagist · phpmyfaq/phpmyfaq, thorsten/phpmyfaq · fixed in 4.1.2
- CVE-2026-4054SVG content served through Mattermost image proxy despite Content-Type restrictions causes client-side denial of serviceGo · github.com/mattermost/mattermost-server · fixed in 11.5.2, 0.0.0-20260414103857-b21ef302025e, 11.4.4 and more
- CVE-2026-42207Magento LTS: Open Redirect via Unvalidated `uenc` Parameter in `stockAction()` - magento-ltsPackagist · openmage/magento-lts · fixed in 20.18.0
- CVE-2026-42155Magento LTS: Weak API Session ID — Predictable MD5 of Time-Derived InputsPackagist · openmage/magento-lts · fixed in 20.18.0
- CVE-2026-42458Magento LTS: Reflected XSS - Import -> Data Flow (profiles)Packagist · openmage/magento-lts · fixed in 20.18.0
- CVE-2026-44714bitcoinj: ScriptExecution P2PKH/P2WPKH Verification BypassMaven · org.bitcoinj:bitcoinj-core · fixed in 0.17.1
- CVE-2026-23695Cockpit CMS 2.14.0 Stored XSS via Set Field Display TemplatePackagist · cockpit-hq/cockpit
- CVE-2026-44774Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=falseGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.46, 3.7.1, 3.6.17
- CVE-2026-41181Traefik: Errors middleware forwards Authorization and Cookie headers to separate error page serviceGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.44, 3.6.15, 3.7.0-rc.3
- CVE-2026-44309gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commitsGo · github.com/sigstore/gitsign · fixed in 0.16.0
- CVE-2026-44310gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callersGo · github.com/sigstore/gitsign · fixed in 0.15.0
- CVE-2026-41258OpenMRS: Stored Velocity SSTI to RCE via ConceptReferenceRangeMaven · org.openmrs.api:openmrs-api · fixed in 2.7.9, 2.8.6
- CVE-2026-46383Microsoft APM: Windows absolute-path tar member overwrite during legacy-bundle probing in `apm install`PyPI · apm-cli · fixed in 0.13.0
- CVE-2026-45539Microsoft APM: Symlinks under `.apm/prompts/` and `.apm/agents/` are dereferenced during `apm install`, copying host-local file contents into the project treePyPI · apm · fixed in 0.13.0