Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-87938CSP log - Critical - SQL Injection - SA-CONTRIB-2026-136Packagist · drupal/csp_log · fixed in 1.0.2
- CVE-2026-87939Feed Block - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-137Packagist · drupal/feed_block · fixed in 2.0.2, 3.0.2
- CVE-2026-87940Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138Packagist · drupal/key_auth · fixed in 2.2.4
- CVE-2026-87942SafeDelete - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-140Packagist · drupal/safedelete · fixed in 1.0.88
- CVE-2026-87943SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141Packagist · drupal/miniorange_saml · fixed in 3.2.0
- CVE-2026-87944SAML SSO - Service Provider - Critical - Improper certificate validation - SA-CONTRIB-2026-142Packagist · drupal/miniorange_saml · fixed in 3.2.0
- CVE-2026-87945SAML SSO - Service Provider - Critical - Open redirect - SA-CONTRIB-2026-143Packagist · drupal/miniorange_saml · fixed in 3.2.0
- CVE-2026-87946SAML SSO - Service Provider - Critical - Weak cryptographic practices - SA-CONTRIB-2026-144Packagist · drupal/miniorange_saml · fixed in 3.2.0
- CVE-2026-87947SAML SSO - Service Provider - Moderately critical - Authentication bypass - SA-CONTRIB-2026-145Packagist · drupal/miniorange_saml · fixed in 3.2.0
- CVE-2026-87948SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-146Packagist · drupal/miniorange_saml · fixed in 3.2.0
- CVE-2026-87949SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-147Packagist · drupal/miniorange_saml · fixed in 3.2.0
- CVE-2026-87950SAML SSO - Service Provider - Moderately critical - Embedded credentials - SA-CONTRIB-2026-148Packagist · drupal/miniorange_saml · fixed in 3.2.0
- CVE-2026-87951SAML SSO - Service Provider - Moderately critical - Information disclosure - SA-CONTRIB-2026-149Packagist · drupal/miniorange_saml · fixed in 3.2.0
- CVE-2026-87952SAML SSO - Service Provider - Moderately critical - Insufficient replay protection - SA-CONTRIB-2026-150Packagist · drupal/miniorange_saml · fixed in 3.2.0
- CVE-2026-87953SAML SSO - Service Provider - Moderately critical - Server Side Request Forgery - SA-CONTRIB-2026-151Packagist · drupal/miniorange_saml · fixed in 3.2.0
- CVE-2026-87954Taxonomy Term Glossary - Critical - Access bypass - SA-CONTRIB-2026-152Packagist · drupal/term_glossary · fixed in 4.6.0
- CVE-2026-87955Ultimate Table Field - Critical - Access bypass - SA-CONTRIB-2026-153Packagist · drupal/ultimate_table_field · fixed in 1.1.1, 2.0.1
- CVE-2026-96360Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-154Packagist · drupal/webform · fixed in 6.2.12, 6.3.1
- CVE-2026-96361Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-155Packagist · drupal/webform · fixed in 6.2.12, 6.3.1
- CVE-2026-96358Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-158Packagist · drupal/webform · fixed in 6.2.12, 6.3.1
- CVE-2026-96359Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-159Packagist · drupal/webform · fixed in 6.2.12, 6.3.1
- CVE-2026-96362Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-160Packagist · drupal/webform · fixed in 6.2.12, 6.3.1
- CVE-2026-96363Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161Packagist · drupal/webform · fixed in 6.2.12, 6.3.1
- CVE-2026-96367Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162Packagist · drupal/webform · fixed in 6.2.12, 6.3.1
- CVE-2026-96368Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-163Packagist · drupal/webform · fixed in 6.2.12, 6.3.1
- CVE-2026-96370Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164Packagist · drupal/webform · fixed in 6.2.12, 6.3.1
- CVE-2026-96369Webform - Less critical - Access bypass - SA-CONTRIB-2026-165Packagist · drupal/webform · fixed in 6.2.12, 6.3.1
- CVE-2026-96371Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166Packagist · drupal/webform · fixed in 6.2.12, 6.3.1
- CVE-2026-96372Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167Packagist · drupal/webform · fixed in 6.2.12, 6.3.1
- CVE-2026-96373Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168Packagist · drupal/webform · fixed in 6.2.12, 6.3.1