Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-37461An out-of-bounds read in the ParseIP6Extended function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) viaGo · github.com/osrg/gobgp/v4 · fixed in 4.4.0
- CVE-2026-38751OpenSTAManager version 2.10 and earlier contains an arbitrary file upload vulnerability in the module update functionality…Packagist · devcode-it/openstamanager
- CVE-2026-7711MindsDB Engine proc_wrapper.py exec unrestricted uploadPyPI · mindsdb
- CVE-2026-7700langflow-ai langflow LambdaFilterComponent lambda_filter.py eval code injectionPyPI · langflow · fixed in 1.10.3
- CVE-2026-7689Dolibarr ERP CRM Online Signature security.lib.php dol_verifyHash signature verificationPackagist · dolibarr/dolibarr
- CVE-2026-7688Dolibarr ERP CRM Shipments API Endpoint expedition.class.php _checkValForAPI sql injectionPackagist · dolibarr/dolibarr
- CVE-2026-7669sgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injectionPyPI · sglang
- CVE-2026-7645ruvnet sublinear-time-solver MCP server.js export_state path traversalnpm · sublinear-time-solver
- CVE-2026-43824In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data.Go · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 +1 · fixed in 3.2.11, 3.3.9
- CVE-2026-7600ArtMin96 yii2-mcp-server MCP index.ts yii_execute_command os command injectionnpm · yii2-mcp-server
- CVE-2026-7597mem0ai mem0 faiss.py pickle.dump deserializationPyPI · mem0ai · fixed in 2.0.0b2
- CVE-2026-7579AstrBotDevs AstrBot Dashboard auth.py hard-coded credentialsPyPI · astrbot
- CVE-2026-42778Apache MINA: CWE-502 Deserialization of Untrusted Data (take 2)Maven · org.apache.mina:mina-core · fixed in 2.1.12, 2.2.7
- CVE-2026-42779Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE (take 2)Maven · org.apache.mina:mina-core · fixed in 2.1.12, 2.2.7
- CVE-2026-42404Apache Neethi: Unrestricted HTTP Redirect Following in Policy ReferencesMaven · org.apache.neethi:neethi · fixed in 3.2.2
- CVE-2026-42402Apache Neethi: Policy Normalization Unbounded Resource Allocation DoSMaven · org.apache.neethi:neethi · fixed in 3.2.2
- CVE-2026-42403Apache Neethi: Circular Policy Reference Infinite LoopMaven · org.apache.neethi:neethi · fixed in 3.2.2
- CVE-2026-40201@diplodoc/search-extension 1.0.0 through 3.x before 3.0.3 allows stored XSS via the title in a .md file.npm · @diplodoc/search-extension · fixed in 3.0.5
- CVE-2026-42474SQL injection vulnerability in MixPHP Framework 2.x thru 2.2.17 via crafted `data` array to the data function in BuildHelper.php.Packagist · mix/mix
- CVE-2026-42475SQL injection vulnerability in MixPHP Framework 2.x thru 2.2.17 via crafted `on` array to the joinOn function in BuildHelper.php.Packagist · mix/mix
- CVE-2026-43001An issue was discovered in OpenStack Keystone before 29.0.2.PyPI · keystone · fixed in 27.0.2, 28.0.2, 29.0.2
- CVE-2026-43003An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0.PyPI · ironic-python-agent · fixed in 11.6.0
- CVE-2026-41263Traefik: BasicAuth middleware: timing side-channel vulnerabilityGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.43, 3.6.14, 3.7.0-rc.2
- CVE-2026-40912Traefik: StripPrefixRegex auth bypass via Path/RawPath desyncGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.43, 3.6.14, 3.7.0-rc.2
- CVE-2026-39858Traefik: Forwarded alias spoofing top pre-auth decision bypassGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.43, 3.7.0-rc.2, 3.6.14
- CVE-2026-35051Traefik: ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass authGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.43, 3.7.0-rc.2, 3.6.14
- CVE-2026-41174Traefik Kubernetes CRD allows unauthorized cross-namespace middleware bindingGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.43, 3.6.14, 3.7.0-rc.2
- CVE-2026-7461OS Command Injection in Amazon ECS Agent via FSx Windows File Server Volume CredentialsGo · github.com/aws/amazon-ecs-agent · fixed in 1.103.0
- CVE-2026-7500Org.keycloak.keycloak-services: improper access control on keycloak server when the account account api feature is disabledMaven · org.keycloak:keycloak-services
- CVE-2026-41016Apache Airflow Providers SMTP: No certificate validation on SMTP STARTTLS connections in SMTP providerPyPI · apache-airflow-providers-smtp · fixed in 3.0.0