Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-42605AzuraCast: Path Traversal in `currentDirectory` Parameter Enables Remote Code Execution via Media UploadPackagist · azuracast/azuracast · fixed in 0.23.6
- CVE-2026-42606AzuraCast: Password Reset Poisoning via Untrusted X-Forwarded-Host Header Leads to Account Takeover and 2FA BypassPackagist · azuracast/azuracast · fixed in 0.23.6
- CVE-2026-42258net-imap: Command Injection via unvalidated Symbol inputsRubyGems · net-imap · fixed in 0.6.4, 0.5.14, 0.4.24
- CVE-2026-42257net-imap: Command Injection via "raw" arguments to multiple commandsRubyGems · net-imap · fixed in 0.6.4, 0.5.14, 0.4.24
- CVE-2026-42256net-imap: Denial of service via high iteration count for `SCRAM-*` authenticationRubyGems · net-imap · fixed in 0.6.4, 0.5.14, 0.4.24
- CVE-2026-42245net-imap: Quadratic complexity when reading response literalsRubyGems · net-imap · fixed in 0.6.4, 0.5.14, 0.4.24
- CVE-2026-42246net-imap vulnerable to STARTTLS stripping via invalid response timingRubyGems · net-imap · fixed in 0.6.4, 0.5.14, 0.4.24 and more
- CVE-2026-42601ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddViewPyPI · archivebox
- CVE-2026-42576apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discoveryGo · chainguard.dev/apko · fixed in 1.2.7
- CVE-2026-42575apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)Go · chainguard.dev/apko · fixed in 1.2.7
- CVE-2026-42574apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build rootGo · chainguard.dev/apko · fixed in 1.2.5
- CVE-2026-42569phpvms: /importer authorization bypass causing full database wipePackagist · nabeel/phpvms · fixed in 7.0.6
- CVE-2026-42571Privilege Escalation Attack affecting Pelican Web UIGo · github.com/pelicanplatform/pelican · fixed in 0.0.0-20260408120501-7f73b9c3e677
- CVE-2026-42333quarkus-openapi-generator has overly broad path-parameter matching that sends authentication headers to unintended operationsMaven · io.quarkiverse.openapi.generator:quarkus-openapi-generator · fixed in 2.16.0-lts, 2.17.0
- CVE-2026-41893Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)npm · signalk-server · fixed in 2.25.0
- CVE-2026-42560auth: Patreon provider assigns the same local user ID to every authenticated Patreon account, enabling cross‑user impersonationGo · github.com/go-pkgz/auth, github.com/go-pkgz/auth/v2 · fixed in 1.25.2, 2.1.2
- CVE-2026-42311Pillow: OOB Write with Invalid PSD Tile Extents (Integer Overflow)PyPI · pillow · fixed in 12.2.0
- CVE-2026-42310Pillow: PDF Parsing Trailer Infinite Loop (DoS)PyPI · pillow · fixed in 12.2.0
- CVE-2026-42308Pillow: Integer overflow when processing fontsPyPI · pillow · fixed in 12.2.0
- CVE-2026-42309Pillow: Heap buffer overflow with nested list coordinatesPyPI · pillow · fixed in 12.2.0
- CVE-2026-41311LiquidJS is vulnerable to Denial of Service via circular block reference in layoutnpm · liquidjs · fixed in 10.25.7
- CVE-2026-42301Improper Input Validation leading to Improper Control of Generation of Code ('Code Injection') in pyp2specPyPI · pyp2spec · fixed in 0.14.1
- CVE-2026-42296Argo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/SecureGo · github.com/argoproj/argo-workflows, github.com/argoproj/argo-workflows/v2 +2 · fixed in 3.7.14, 4.0.5
- CVE-2026-42295Argo Workflows: Exposure of artifact repository credentialsGo · github.com/argoproj/argo-workflows, github.com/argoproj/argo-workflows/v2 +2 · fixed in 4.0.5
- CVE-2026-42294Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook InterceptorGo · github.com/argoproj/argo-workflows, github.com/argoproj/argo-workflows/v2 +2 · fixed in 3.7.14, 4.0.5
- CVE-2026-42183Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)Go · github.com/argoproj/argo-workflows, github.com/argoproj/argo-workflows/v2 +2 · fixed in 4.0.5
- CVE-2026-42297Argo Workflows Is Missing Authorization in Sync ConfigMap ProviderGo · github.com/argoproj/argo-workflows, github.com/argoproj/argo-workflows/v2 +2 · fixed in 4.0.5
- CVE-2026-42174Kirby: User avatar creation, replacement and deletion are not gated by user update permissionsPackagist · getkirby/cms · fixed in 4.9.0, 5.4.0
- CVE-2026-42137Kirby: `pages.access/list` and `files.access/list` permissions are not consistently checked in the REST API and changes dialogPackagist · getkirby/cms · fixed in 4.9.0, 5.4.0
- CVE-2026-42051Kirby: System API endpoint leaks license data and installed version to authenticated usersPackagist · getkirby/cms · fixed in 4.9.0, 5.4.0