Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-41423Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Servernpm · @angular/platform-server · fixed in 22.0.0-next.8, 21.2.9, 20.3.19 and more
- CVE-2026-41161Username Enumeration via Timing Attacknpm · @sync-in/server · fixed in 2.2.0
- CVE-2026-8149GCM chunking can lead to bad tag exception on decryptionMaven · org.bouncycastle:bcprov-lts8on · fixed in 2.73.11
- CVE-2026-42275zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/writeGo · github.com/openziti/zrok, github.com/openziti/zrok/v2 · fixed in 2.0.2
- CVE-2026-42274Heimdall: Authorization bypass via path normalization mismatchGo · github.com/dadrus/heimdall · fixed in 0.17.14
- CVE-2026-42273Heimdall: Case-sensitive host matching may lead to policy bypassGo · github.com/dadrus/heimdall · fixed in 0.17.14
- CVE-2026-42272Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretationGo · github.com/dadrus/heimdall · fixed in 0.17.14
- CVE-2026-42208LiteLLM: SQL injection in Proxy API key verificationPyPI · litellm · fixed in 1.83.7
- CVE-2026-42203LiteLLM: Server-Side Template Injection in /prompts/test endpointPyPI · litellm · fixed in 1.83.7
- CVE-2026-42271LiteLLM: Authenticated command execution via MCP stdio test endpointsPyPI · litellm · fixed in 1.83.7
- CVE-2026-44298Kimai: Arbitrary file read in invoice PDF renderer (admin)Packagist · kimai/kimai · fixed in 2.56
- CVE-2026-41498Kimai: Team API Missing Object-Level AuthorizationPackagist · kimai/kimai · fixed in 2.54.0
- CVE-2026-42267Kimai: Formula Injection via tag names in XLSX exportPackagist · kimai/kimai · fixed in 2.54.0
- CVE-2026-41900OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environmentnpm · openlearnx · fixed in 2.0.3
- CVE-2026-42150wlc: print_html outputs API data without HTML escaping, enabling stored XSSPyPI · wlc · fixed in 2.0.0
- CVE-2026-42264Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijackingnpm · axios · fixed in 1.15.2
- CVE-2026-41645Nuclei: Environment variable disclosure via Response-Derived DSL ExpressionsGo · github.com/projectdiscovery/nuclei, github.com/projectdiscovery/nuclei/v2 +1 · fixed in 3.8.0
- CVE-2026-41646Nuclei: Local File Read via require() Module Loader BypassGo · github.com/projectdiscovery/nuclei, github.com/projectdiscovery/nuclei/v2 +1 · fixed in 3.8.0
- CVE-2026-43944electerm: dangerous code can be run through links or command linenpm · electerm · fixed in 3.8.8
- CVE-2026-43942electerm: Full process.env exposed to renderer via window.pre.env in electermnpm · electerm
- CVE-2026-43941Unvalidated shell.openExternal in electerm allows arbitrary protocol execution via terminal link clicknpm · electerm
- CVE-2026-43940electerm: Path traversal in electerm runWidget leads to arbitrary code executionnpm · electerm · fixed in 3.7.16
- CVE-2026-43943electerm: RCE via malicious SSH server filename in openFileWithEditornpm · electerm · fixed in 3.7.9
- CVE-2026-41500electerm has Command Injection Vulnerability via runMac functionnpm · electerm · fixed in 3.3.8
- CVE-2026-41501electerm has Command Injection Vulnerability via runLinux functionnpm · electerm · fixed in 3.3.8
- CVE-2023-42343A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type.Maven · org.opencms:opencms-core · fixed in 16.0
- CVE-2023-42344Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on Maven · org.opencms:opencms-core · fixed in 10.5.1
- CVE-2023-42345A Cross Site Scripting vulnerability in Alkacon OpenCms before 16 exists via updateModelGroups.jsp.Maven · org.opencms:opencms-core · fixed in 16.0
- CVE-2023-42346Alkacon OpenCms before 16 allows XXE when the <!DOCTYPE> refers to an external host.Maven · org.opencms:opencms-core · fixed in 16.0
- CVE-2024-51092LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(),Packagist · librenms/librenms · fixed in 24.10.0