Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-42215GitPython: Command injection via Git options bypassPyPI · gitpython · fixed in 3.1.47
- CVE-2026-44742Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wildPyPI · postorius
- CVE-2026-44349Daptin fuzzy search injects unvalidated column name into raw SQLGo · github.com/daptin/daptin · fixed in 0.11.5
- CVE-2026-41422Daptin vulnerable to SQL injection via unvalidated goqu.L() calls in aggregate APIGo · github.com/daptin/daptin · fixed in 0.11.4
- CVE-2026-44264Weblate is vulnerable to XSS via crafted MarkdownPyPI · weblate · fixed in 5.17.1
- CVE-2026-44263Weblate: Private Translation Enumeration via Screenshot APIPyPI · weblate · fixed in 5.17.1
- CVE-2026-41519Weblate's API Token Not Invalidated on Password ChangePyPI · weblate · fixed in 5.17.1
- CVE-2026-41654Weblate is Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_urlPyPI · weblate · fixed in 5.17.1
- CVE-2026-41650fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimitersnpm · fast-xml-parser · fixed in 5.7.0
- CVE-2026-41589Wish has SCP Path Traversal that allows arbitrary file read/writeGo · charm.land/wish/v2, github.com/charmbracelet/wish · fixed in 2.0.1
- CVE-2026-41490Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager IntegrationsPyPI · dagster, dagster-deltalake +4 · fixed in 1.13.1, 0.29.1
- CVE-2026-41685Incus: Unbounded binary import disk exhaustionGo · github.com/lxc/incus, github.com/lxc/incus/v6 +1
- CVE-2026-41684Incus: Nil Dereferences on Restore via Malformed YAMLGo · github.com/lxc/incus, github.com/lxc/incus/v6 +1
- CVE-2026-41648Incus: Unbounded YAML Metadata Decode via ParsingGo · github.com/lxc/incus, github.com/lxc/incus/v6 +1
- CVE-2026-41647Incus: Nil-Pointer Dereference via S3 Bucket ImportGo · github.com/lxc/incus, github.com/lxc/incus/v6 +1
- CVE-2026-41644monetr is vulnerable to server-side request forgery in Lunch Flow link creation and refreshGo · github.com/monetr/monetr · fixed in 1.12.5
- CVE-2026-41643GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATEGo · github.com/osrg/gobgp/v4 · fixed in 4.3.0
- CVE-2026-42285GoBGP: Panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference)Go · github.com/osrg/gobgp/v4 · fixed in 4.5.0
- CVE-2026-41642GoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path AttributeGo · github.com/osrg/gobgp/v4 · fixed in 4.4.0
- CVE-2026-41586ObjectInputStream.readObject() without ObjectInputFilter in fabric-sdk-java allows Java deserialization RCEMaven · org.hyperledger.fabric-sdk-java:fabric-sdk-java
- CVE-2026-41143YesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave()Packagist · yeswiki/yeswiki · fixed in 4.6.1
- CVE-2026-41139Unsafe array index getter in mathjsnpm · mathjs · fixed in 15.2.0
- CVE-2026-41413Istio Vulnerable to SSRF via RequestAuthentication jwksUriGo · istio.io/istio · fixed in 0.0.0-20260410004459-189832a289c1
- CVE-2026-41641NocoBase Vulnerable to SQL Validation Bypass via `sqlCollection:update` Missing `checkSQL` Callnpm · @nocobase/plugin-collection-sql · fixed in 2.0.39
- CVE-2026-41640NocoBase Vulnerable to SQL Injection via String Concatenation in Recursive Eager Loadingnpm · @nocobase/database · fixed in 2.0.39
- CVE-2026-40981When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentiaMaven · org.springframework.cloud:spring-cloud-config-server · fixed in 4.3.3, 5.0.3
- CVE-2026-41002The base directory (`spring.cloud.config.server.git.basedir`) used by the Spring Cloud Config Server to clone Git repositories to is susceptMaven · org.springframework.cloud:spring-cloud-config-server · fixed in 4.3.3, 5.0.3
- CVE-2026-41004When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs.Maven · org.springframework.cloud:spring-cloud-config-server · fixed in 4.3.3, 5.0.3
- CVE-2026-41675xmldom: XML node injection through unvalidated processing instruction serializationnpm · @xmldom/xmldom, xmldom · fixed in 0.8.13, 0.9.10
- CVE-2026-40982Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module.Maven · org.springframework.cloud:spring-cloud-config-server · fixed in 4.3.3, 5.0.3