Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-41674xmldom: XML injection through unvalidated DocumentType serializationnpm · @xmldom/xmldom, xmldom · fixed in 0.8.13, 0.9.10
- CVE-2026-41673xmldom: Denial of service via uncontrolled recursion in XML serializationnpm · @xmldom/xmldom, xmldom · fixed in 0.8.13, 0.9.10
- CVE-2026-41672xmldom: XML node injection through unvalidated comment serializationnpm · @xmldom/xmldom, xmldom · fixed in 0.8.13, 0.9.10
- CVE-2026-41891CI4MS: Deactivated User Session Bypass (active=0)Packagist · ci4-cms-erp/ci4ms · fixed in 0.31.8.0
- CVE-2026-41890CI4MS: Arbitrary Database Table Drop via Theme deleteProcessPackagist · ci4-cms-erp/ci4ms · fixed in 0.31.8.0
- CVE-2026-41203ci4ms Theme::upload is vulnerable to Zip Slip leading to RCEPackagist · ci4-cms-erp/ci4ms · fixed in 0.31.5.0
- CVE-2026-41202ci4ms Backup::restore is vulnerable to Zip Slip leading to RCEPackagist · ci4-cms-erp/ci4ms · fixed in 0.31.5.0
- CVE-2026-41201CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS Version 2Packagist · ci4-cms-erp/ci4ms · fixed in 0.31.5.0
- CVE-2026-41587CI4MS: Unrestricted PHP File Upload via Theme Installation Leads to Authenticated Remote Code ExecutionPackagist · ci4-cms-erp/ci4ms · fixed in 0.31.7.0
- CVE-2026-42194Incomplete fix for CVE-2026-32812: SSRF in admidioPackagist · admidio/admidio · fixed in 5.0.9
- CVE-2026-41671Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without ValidationPackagist · admidio/admidio · fixed in 5.0.9
- CVE-2026-41670Admidio: SAML Response Sent to Unvalidated Assertion Consumer Service URL from AuthnRequestPackagist · admidio/admidio · fixed in 5.0.9
- CVE-2026-41669Admidio: SAML Signature Validation Result Ignored — Forged AuthnRequests and LogoutRequests ProcessedPackagist · admidio/admidio · fixed in 5.0.9
- CVE-2026-41663Admidio: CSRF on Admin Preferences Triggers Unauthorized Backup, .htaccess Write, and Email SendPackagist · admidio/admidio · fixed in 5.0.9
- CVE-2026-41662Admidio: Missing Minimum Administrator Check in Role Membership RemovalPackagist · admidio/admidio · fixed in 5.0.9
- CVE-2026-41661Admidio: Reflected XSS in msg_window.php via Square Bracket to HTML Tag ConversionPackagist · admidio/admidio · fixed in 5.0.9
- CVE-2026-41660Admidio: Inverted 2FA Reset Authorization Check Lets Group Leaders Strip Admin TOTPPackagist · admidio/admidio · fixed in 5.0.9
- CVE-2026-41659Admidio: Hidden Profile Field Values Leaked via Blind Search Oracle in Member AssignmentPackagist · admidio/admidio · fixed in 5.0.9
- CVE-2026-41658Admidio: Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete ItemsPackagist · admidio/admidio · fixed in 5.0.9
- CVE-2026-41657Admidio: Cross-Organization Member Data Exposure via Permission Check Mismatch in contacts_data.phpPackagist · admidio/admidio · fixed in 5.0.9
- CVE-2026-41656Admidio: Path Traversal via Unvalidated `name` Parameter in Document Add Mode Enables Arbitrary Server File ReadPackagist · admidio/admidio · fixed in 5.0.9
- CVE-2026-41655Admidio: Path Traversal in ECard Preview Allows Reading Arbitrary Server Files Including Database CredentialsPackagist · admidio/admidio · fixed in 5.0.9
- CVE-2025-63703npm package parse-ini v1.0.6 is vulnerable to Prototype Pollution in index.js().npm · parse-ini
- CVE-2025-63704NPM package query-parser-string 1.0.0 is vulnerable to Prototype Pollution.npm · query-string-parser
- CVE-2025-63705NPM package node-ts-ocr 1.0.15 is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js.npm · node-ts-ocr
- CVE-2025-63706NPM package next-npm-version1.0.1 is vulnerable to Command injection.npm · @jswork/next-npm-version
- CVE-2025-65122Regex Denial of Service in youtube-regex npm package through version 1.0.5.npm · youtube-regex
- CVE-2025-67202Sidekiq-cron thru 2.3.1, an open-source scheduling add-on for Sidekiq, is vulnerable to a cross-site scripting (xss) vulnerability via craftRubyGems · sidekiq-cron · fixed in 2.4.0
- CVE-2026-36341Cross-Site Scripting (XSS) vulnerability exists in Webkul Krayin CRM v2.1.5.Packagist · krayin/laravel-crm · fixed in 2.1.6
- CVE-2026-37709Insecure Permissions vulnerability in grokability snipe-it v.8.4.0 and before and fixed after 2026-03-10 commit 676a9958 allows a remote attPackagist · snipe/snipe-it · fixed in 8.4.1