Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-42069Kirby: Read access to site, user and role information is not gated by permissionsPackagist · getkirby/cms · fixed in 4.9.0, 5.4.0
- CVE-2026-42461Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets)Go · github.com/getarcaneapp/arcane/backend · fixed in 1.18.0
- CVE-2026-41705Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs.Maven · org.springframework.ai:spring-ai-milvus-store, org.springframework.ai:spring-ai-typesense-store · fixed in 1.0.7, 1.1.6
- CVE-2026-42354Sentry: Improper authentication on SAML SSO process allows user identity linkingPyPI · sentry · fixed in 26.4.1
- CVE-2026-42350Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Query ParameterGo · github.com/akuity/kargo · fixed in 1.7.10, 1.8.13, 1.9.8 and more
- CVE-2026-42352pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes SubscriberPyPI · pygeoapi · fixed in 0.23.3
- CVE-2026-42351pygeoapi: Path Traversal in STAC FileSystemProviderPyPI · pygeoapi · fixed in 0.23.3
- CVE-2026-42339New API: SSRF Filter Bypass via 0.0.0.0Go · github.com/quantumnous/new-api
- CVE-2026-41432New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota FraudGo · github.com/quantumnous/new-api · fixed in 0.12.10
- CVE-2026-42224ipl/web is vulnerable to reflected XSS by malformed search requestsPackagist · ipl/web · fixed in 0.13.1, 0.10.3
- CVE-2026-41520Cillium exposes sensitive information included in the cilium-bugtool debug archiveGo · github.com/cilium/cilium · fixed in 1.17.15, 1.18.9, 1.19.3
- CVE-2026-42206Roadiz OpenID Connect nonce generated but never validated — ID token replay attackPackagist · roadiz/openid · fixed in 2.7.18, 2.6.31, 2.5.45 and more
- CVE-2026-41486Ray: Remote Code Execution via Parquet Arrow Extension Type DeserializationPyPI · ray, ve-ray · fixed in 2.55.0
- CVE-2026-42205Avo: Broken Access Control: Unauthorized Execution of Arbitrary Action Classes Across ResourcesRubyGems · avo · fixed in 3.31.2
- CVE-2026-42202nova-toggle-5: Improper authorization on toggle endpoint allowed non-Nova users to modify boolean fieldsPackagist · almirhodzic/nova-toggle-5 · fixed in 1.3.0
- CVE-2026-42199Grid: Integer Overflow in Grid::expand_rows Leads to Safe-API Undefined Behaviorcrates.io · grid · fixed in 1.0.1
- CVE-2026-42189Russh: Pre-auth DoS via unbounded allocation in keyboard-interactive authcrates.io · russh · fixed in 0.60.1
- CVE-2026-42190RedwoodSDK: Same-site CSRF in in server actionsnpm · rwsdk · fixed in 1.2.3
- CVE-2026-42180Lemmy: SSRF in /api/v3/post via Webmention dispatchcrates.io · lemmy_api_common · fixed in 0.19.18
- CVE-2026-42181Lemmy: SSRF and internal image disclosure in post link metadata via unvalidated og:imagecrates.io · lemmy_api_common · fixed in 0.19.18
- CVE-2026-44694n8n-MCP: Authenticated SSRF in n8n-mcp webhook and API client pathsnpm · n8n-mcp · fixed in 2.50.2
- CVE-2026-42282n8n-MCP: Sensitive MCP tool-call arguments logged on authenticated requests in HTTP modenpm · n8n-mcp · fixed in 2.47.13
- CVE-2026-41495n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp Requestsnpm · n8n-mcp · fixed in 2.47.11
- CVE-2026-41511OpenMcdf has an Infinite loop DoS via crafted CFB directory cycleNuGet · openmcdf · fixed in 3.1.3
- CVE-2026-8178Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC DriverMaven · com.amazon.redshift:redshift-jdbc42 · fixed in 2.2.2
- CVE-2026-42072Nornicdb: Improper Network Binding in NornicDB Bolt Server allows unauthorized remote accessGo · github.com/orneryd/nornicdb · fixed in 1.0.42-hotfix
- CVE-2026-41889pgx: SQL Injection via placeholder confusion with dollar quoted string literalsGo · github.com/jackc/pgx, github.com/jackc/pgx/v4 +1 · fixed in 5.9.2
- CVE-2026-41887Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)Packagist · flarum/core · fixed in 1.8.16, 2.0.0-rc.1
- CVE-2026-41886locize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext Editornpm · locize · fixed in 4.0.21
- CVE-2026-41885Path traversal / URL injection via unsanitised lng/ns/projectId/version in i18next-locize-backendnpm · i18next-locize-backend · fixed in 9.0.2