Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-13030All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint.PyPI · django-mdeditor
- CVE-2026-7446VetCoders mcp-server-semgrep MCP index.ts create_rule os command injectionnpm · mcp-server-semgrep · fixed in 1.0.1
- CVE-2026-36340An issue in Krayin CRM v.2.1.5 and fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose email functionPackagist · krayin/laravel-crm · fixed in 2.1.6
- CVE-2026-36766Multiple authenticated cross-site scripting (XSS) vulnerabilities in the XssHttpServletRequestWrapper class of shopizer v3.2.5 allows attackMaven · com.shopizer:shopizer
- CVE-2026-36767A path traversal vulnerability in the /content/images/add endpoint of shopizer v3.2.5 allows attackers write arbitrary files to any writeablMaven · com.shopizer:shopizer
- CVE-2026-7404getsimpletool mcpo-simple-server base_manager.py delete_shared_prompt path traversalPyPI · mcpo-simple-server
- CVE-2026-42198pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoSMaven · org.postgresql:postgresql · fixed in 42.7.11
- CVE-2026-42525Jenkins Microsoft Entra ID (previously Azure AD) Plugin 666.v6060de32f87d and earlier does not restrict the redirect URL after login, allowiMaven · org.jenkins-ci.plugins:azure-ad · fixed in 667.v4c5827a
- CVE-2026-42524Jenkins HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper file, resulting in a stored cross-site Maven · org.jenkins-ci.plugins:htmlpublisher · fixed in 427.1
- CVE-2026-42523Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part of JavaScript implementing validation of the featuMaven · com.coravy.hudson.plugins.github:github · fixed in 1.46.0.1
- CVE-2026-42522A missing permission check in Jenkins GitHub Branch Source Plugin 1967.vdea_d580c1a_b_a_ and earlier allows attackers with Overall/Read permMaven · org.jenkins-ci.plugins:github-branch-source · fixed in 1967.1969.v205fd594c821
- CVE-2026-42521Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructors of classes specifiMaven · org.jenkins-ci.plugins:matrix-auth · fixed in 3.2.10
- CVE-2026-42520Jenkins Credentials Binding Plugin 719.v80e905ef14eb_ and earlier does not sanitize file names for file and zip file credentials, allowing aMaven · org.jenkins-ci.plugins:credentials-binding · fixed in 720.v3f6decef43ea
- CVE-2026-42519A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows attackers with Overall/Read permission tMaven · org.jenkins-ci.plugins:script-security · fixed in 1402.v94c9ce464861
- CVE-2026-22745CVE-2026-22745 : Denial of service in static resource handling on Windows platformsMaven · org.springframework:spring-webflux, org.springframework:spring-webmvc · fixed in 7.0.7, 6.2.18
- CVE-2026-22741Static resource cache poisoning in Spring MVC and WebFluxMaven · org.springframework:spring-webflux, org.springframework:spring-webmvc · fixed in 7.0.7, 6.2.18
- CVE-2026-22740Spring Framework DoS with Multipart Temp Files in WebFluxMaven · org.springframework:spring-webflux · fixed in 7.0.7, 6.2.18
- CVE-2026-42615GCHQ CyberChef before 11.0.0 allows XSS via Show Base64 offsets, as demonstrated by the /#recipe=Show_Base64_offsets('%3Cscript substring.npm · cyberchef · fixed in 11.0.0
- CVE-2026-38991Cockpit 2.13.5 and earlier is affected by a misconfiguration within the Bucket component _isFileTypeAllowed function where a specially craftPackagist · cockpit-hq/cockpit · fixed in 2.14.0
- CVE-2026-38992Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple endpoints.Packagist · cockpit-hq/cockpit · fixed in 2.14.0
- CVE-2026-38993Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component.Packagist · cockpit-hq/cockpit · fixed in 2.14.0
- CVE-2026-33467Improper Verification of Cryptographic Signature in Elastic Package Registry Leading to Package Integrity BypassGo · github.com/elastic/package-registry · fixed in 1.38.0
- CVE-2026-7317Grav CMS Cache Value FileCache.php doGet deserializationPackagist · getgrav/grav · fixed in 2.0.0-beta.2
- CVE-2026-7303Xuxueli xxl-job Execution Log JobLogController.java logDetailCat resource injectionMaven · com.xuxueli:xxl-job-admin · fixed in 3.4.0
- CVE-2026-42432OpenClaw < 2026.4.8 - Command Escalation via Node Pairing Reconnect Bypassnpm · openclaw · fixed in 2026.4.8
- CVE-2026-42431OpenClaw < 2026.4.8 - Persistent Profile Mutation via node.invoke(browser.proxy) Bypassnpm · openclaw · fixed in 2026.4.8
- CVE-2026-42430OpenClaw < 2026.4.8 - Strict Browser SSRF Bypass via Playwright Redirect Handlingnpm · openclaw · fixed in 2026.4.8
- CVE-2026-42429OpenClaw < 2026.4.8 - Privilege Escalation via Gateway Plugin HTTP Authenticationnpm · openclaw · fixed in 2026.4.8
- CVE-2026-42428OpenClaw < 2026.4.8 - Missing Integrity Verification in Package Downloadsnpm · openclaw · fixed in 2026.4.8
- CVE-2026-42427OpenClaw < 2026.4.8 - Remote Code Execution via Build Tool Environment Variable Injectionnpm · openclaw · fixed in 2026.4.8