Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-55449AstrBotDevs AstrBot 3.5.15 has Advanced_System_for_Text_Response_and_Bot_Operations_Tool as the hardcoded private key used to sign a JWT.PyPI · astrbot · fixed in 3.5.18
- CVE-2026-38360Directory Traversal vulnerability in fohrloop dash-uploader v.0.1.0 through v.0.7.0a2 allows a remote attacker to execute arbitrary code viaPyPI · dash-uploader
- CVE-2026-38361Multiple unauthenticated denial-of-service (DoS) issues in fohrloop dash-uploader v0.1.0 through v0.7.0a2.PyPI · dash-uploader · fixed in 0.7.0a1
- CVE-2026-8115gyoridavid short-video-maker REST API rest.ts path traversalnpm · short-video-maker
- CVE-2026-42880ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret ExtractionGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 +1 · fixed in 3.2.11, 3.3.9
- CVE-2026-42449n8n-MCP: IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embeddersnpm · n8n-mcp · fixed in 2.47.14
- CVE-2026-42047Inngest TypeScript SDK exposes environment variables via serve() handler on unhandled HTTP methodsnpm · inngest · fixed in 3.54.0
- CVE-2026-41691i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/nsnpm · i18next-http-backend · fixed in 3.0.5
- CVE-2026-41692i18nextify is vulnerable to DOM XSS via javascript:/data: URL schemes in translated href/src attributesnpm · i18nextify · fixed in 4.0.8
- CVE-2026-39820Quadratic string concatentation in consumeComment in net/mailGo · stdlib · fixed in 1.25.10, 1.26.3
- CVE-2026-42501Malicious module proxy can bypass checksum database in cmd/goGo · toolchain · fixed in 1.25.10, 1.26.3
- CVE-2026-39823Bypass of meta content URL escaping causes XSS in html/templateGo · stdlib · fixed in 1.25.10, 1.26.3
- CVE-2026-33811Crash when handling long CNAME response in netGo · stdlib · fixed in 1.25.10, 1.26.3
- CVE-2026-39826Escaper bypass leads to XSS in html/templateGo · stdlib · fixed in 1.25.10, 1.26.3
- CVE-2026-39817Invoking "go tool pack" does not sanitize output paths in cmd/goGo · toolchain · fixed in 1.25.10, 1.26.3
- CVE-2026-39819Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/goGo · toolchain · fixed in 1.25.10, 1.26.3
- CVE-2026-42499Quadratic string concatenation in consumePhrase in net/mailGo · stdlib · fixed in 1.25.10, 1.26.3
- CVE-2026-39825ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputilGo · stdlib · fixed in 1.25.10, 1.26.3
- CVE-2026-39836Panic in Dial and LookupPort when handling NUL byte on Windows in netGo · stdlib · fixed in 1.25.10, 1.26.3
- CVE-2026-33814Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/netGo · golang.org/x/net, stdlib · fixed in 0.53.0, 1.25.10, 1.26.3
- CVE-2026-8088OSGeo gdal GDapi.c GDfieldinfo out-of-boundsPyPI · gdal · fixed in 3.13.0
- CVE-2026-8087OSGeo gdal GDapi.c GDnentries heap-based overflowPyPI · gdal · fixed in 3.13.0
- CVE-2026-42259Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass)npm · @saltcorn/server · fixed in 1.4.6, 1.5.6, 1.6.0-beta.5
- CVE-2026-42241ParquetSharp: Possible Stack Overflow When Reading a ParquetFile with Large Decimal Type WidthNuGet · parquetsharp · fixed in 23.0.0.1
- CVE-2026-42239Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeovernpm · @budibase/backend-core · fixed in 3.35.10
- CVE-2026-8086OSGeo gdal SWapi.c SWnentries heap-based overflowPyPI · gdal · fixed in 3.13.0
- CVE-2026-8084OSGeo gdal HDF-EOS Grid File SWapi.c memmove out-of-boundsPyPI · gdal · fixed in 3.13.0
- CVE-2026-44243GitPython: Path traversal in GitPython reference APIs allows arbitrary file write and delete outside the repositoryPyPI · gitpython · fixed in 3.1.48
- CVE-2026-44244GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPathPyPI · gitpython · fixed in 3.1.49
- CVE-2026-42284GitPython: Unsafe option check validates multi_options before shlex.split transforms itPyPI · gitpython · fixed in 3.1.47