Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-42609Grav: Administrative Account Disruption and Privilege De-escalation via User Overwrite LogicPackagist · getgrav/grav · fixed in 2.0.0-beta.2
- CVE-2026-42608Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component.Packagist · getgrav/grav · fixed in 2.0.0-beta.2
- CVE-2026-42607Grav: Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install FeaturePackagist · getgrav/grav · fixed in 2.0.0-beta.2
- CVE-2026-42841Grav: Stored XSS via Markdown media attribute() action in Grav CMSPackagist · getgrav/grav · fixed in 2.0.0-beta.2
- CVE-2026-44201Wagtail: Improper restriction handling on Documents and Images APIPyPI · wagtail · fixed in 7.0.7, 7.3.2
- CVE-2026-44200Wagtail: Improper permission handling when copying pagesPyPI · wagtail · fixed in 7.0.7, 7.3.2
- CVE-2026-44199Wagtail: Improper permission handling when deleting form submissionsPyPI · wagtail · fixed in 7.0.7, 7.3.2
- CVE-2026-44198Wagtail: Improper permission handling when viewing page historyPyPI · wagtail · fixed in 7.0.7, 7.3.2
- CVE-2026-44197Wagtail: Improper permission handling when comparing revisionsPyPI · wagtail · fixed in 7.0.7, 7.3.2
- CVE-2026-7820pgAdmin 4: Account-lockout bypass via Flask-Security default /login viewPyPI · pgadmin4 · fixed in 9.15
- CVE-2026-7819pgAdmin 4: Symbolic-link path traversal in File Manager allows arbitrary file writePyPI · pgadmin4 · fixed in 9.15
- CVE-2026-7818pgAdmin 4: Unsafe deserialization (CWE-502) in file-backed session manager leads to remote code executionPyPI · pgadmin4 · fixed in 9.15
- CVE-2026-7817pgAdmin 4: Local file inclusion and server-side request forgery in LLM API configuration endpointsPyPI · pgadmin4 · fixed in 9.15
- CVE-2026-7816pgAdmin 4: OS command injection in Import/Export query export via psql metacommand breakoutPyPI · pgadmin4 · fixed in 9.15
- CVE-2026-7815pgAdmin 4: SQL injection in Maintenance tool option values leading to remote code executionPyPI · pgadmin4 · fixed in 9.15
- CVE-2026-7814pgAdmin 4: Stored XSS via crafted PostgreSQL object names in Browser Tree and Explain VisualizerPyPI · pgadmin4 · fixed in 9.15
- CVE-2026-7813pgAdmin 4: Cross-user data access and shared-server privilege escalation in server modePyPI · pgadmin4 · fixed in 9.15
- CVE-2026-44643Angular Expressions - Remote Code Execution using filtersnpm · angular-expressions · fixed in 1.5.2
- CVE-2026-41018Apache Airflow Providers Elasticsearch: Elasticsearch task-log handler leaks credentials embedded in the host URLPyPI · apache-airflow-providers-elasticsearch · fixed in 6.5.3
- CVE-2026-43826Apache Airflow Providers OpenSearch: OpenSearch task-log handler leaks credentials embedded in the host URLPyPI · apache-airflow-providers-opensearch · fixed in 1.9.1
- CVE-2026-8276bettercap MySQL Server mysql_server.go integer coercionGo · github.com/bettercap/bettercap/v2 · fixed in 2.41.7
- CVE-2026-8275bettercap zerogod IPP Service zerogod_ipp_primitives.go ippReadChunkedBody integer coercionGo · github.com/bettercap/bettercap, github.com/bettercap/bettercap/v2 · fixed in 2.41.7
- CVE-2026-30635Command injection vulnerability in automagik-genie 2.5.27 MCP Server allows attackers to execute arbitrary commands via the view_task (aka vnpm · automagik-genie
- CVE-2026-31246GPT-Pilot thru commit 0819827ce20346ef5f25b3fe29293cb448840565 (2025-09-03) contains a command injection vulnerability (CWE-78) in the ExecuPyPI · gpt-pilot
- CVE-2026-31247Docling's JATS XML backend is vulnerable to XML Entity Expansion (XXE) attacks thru 2.61.0.PyPI · docling
- CVE-2026-31248Docling's METS GBS backend is vulnerable to XML Entity Expansion (XXE) attacks thru 2.61.0.PyPI · docling
- CVE-2026-31253The flash-attention training framework thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains an insecure deserializatioPyPI · flash-attn
- CVE-2021-47935Sentry 8.2.0 Remote Code Execution via Pickle DeserializationPyPI · sentry · fixed in 8.1.4, 8.2.2
- CVE-2026-8213OSGeo gdal Grid File GDapi.c GDSDfldsrch heap-based overflowPyPI · gdal · fixed in 3.13.0
- CVE-2026-8212OSGeo gdal SWapi.c SWSDfldsrch heap-based overflowPyPI · gdal · fixed in 3.13.0RC1