Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-22748Potential Security Misconfiguration when Using withIssuerLocationMaven · org.springframework.security:spring-security-oauth2-jose · fixed in 6.5.10, 7.0.5
- CVE-2026-22747Unauthorized User Impersonation when Using X.509 Client CertificatesMaven · org.springframework.security:spring-security-web · fixed in 7.0.5
- CVE-2026-22746User Attribute Enumeration when Using DaoAuthenticationProviderMaven · org.springframework.security:spring-security-core · fixed in 6.5.10, 7.0.5
- CVE-2026-41146facil.io and downstream iodine ruby gem vulnerable to uncontrolled resource consumption and loop with unreachable exit conditionRubyGems · iodine
- CVE-2026-41145MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer UploadsGo · github.com/minio/minio
- CVE-2026-40344MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer UploadsGo · github.com/minio/minio
- CVE-2026-30139A reflected cross-site scripting (XSS) vulnerability in the AdvancedSearch functionality of Silverpeas Core before version 6.4.6 allows attaMaven · org.silverpeas.core:silverpeas-core-war, org.silverpeas.core:silverpeas-core-web
- CVE-2026-41136free5GC AMF missing default case in Content-Type switch in HTTPUEContextTransferGo · github.com/free5gc/amf
- CVE-2026-41135free5GC PCF: Memory Leak via CORS Middleware Registration in HTTP Handler Leads to Denial of ServiceGo · github.com/free5gc/pcf · fixed in 1.4.3
- CVE-2026-40343free5GC UDR: Fail-open handling in PolicyDataSubsToNotifyPost allows unintended subscription creationGo · github.com/free5gc/udr
- CVE-2026-41133pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)PyPI · pyload-ng
- CVE-2026-41131OpenFGA has Improper Policy EnforcementGo · github.com/openfga/openfga · fixed in 1.14.1
- CVE-2026-41130Craft CMS has a host header injection leading to SSRF via resource-js endpointPackagist · craftcms/cms · fixed in 5.9.15, 4.17.9
- CVE-2026-41129Craft CMS has Server-Side Request Forgery (SSRF) with Asset Uploads MutationsPackagist · craftcms/cms · fixed in 5.9.15, 4.17.9
- CVE-2026-41128Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions ActionPackagist · craftcms/cms · fixed in 5.9.15
- CVE-2026-40575OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header SpoofingGo · github.com/oauth2-proxy/oauth2-proxy, github.com/oauth2-proxy/oauth2-proxy/v7 · fixed in 7.15.2
- CVE-2026-41059OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regexGo · github.com/oauth2-proxy/oauth2-proxy, github.com/oauth2-proxy/oauth2-proxy/v7 · fixed in 7.15.2
- CVE-2026-41304WWBN AVideo vulnerable to RCE caused by clonesite pluginPackagist · wwbn/avideo
- CVE-2026-41064AVideo has an incomplete fix for CVE-2026-33502 (Command Injection)Packagist · wwbn/avideo
- CVE-2026-41063WWBN AVideo has incomplete fix for CVE-2026-33500 (XSS)Packagist · wwbn/avideo
- CVE-2026-41062WWBN/AVideo has an incomplete fix for a directory traversal bypass via query string in ReceiveImage downloadURL parametersPackagist · wwbn/avideo
- CVE-2026-41061WWBN AVideo Vulnerable to stored XSS via Unanchored Duration Regex in Video Encoder ReceiverPackagist · wwbn/avideo
- CVE-2026-41060AVideo's SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURLPackagist · wwbn/avideo
- CVE-2026-41058AVideo has an incomplete fix for CVE-2026-33293 (Path Traversal) in AVideoPackagist · wwbn/avideo
- CVE-2026-41057AVideo has CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) that Exposes Authenticated API ResponsesPackagist · wwbn/avideo
- CVE-2026-41056AVideos has CORS Origin Reflection with Credentials on Sensitive API Endpoints that Enables Cross-Origin Account TakeoverPackagist · wwbn/avideo
- CVE-2026-41055AVideo has an incomplete fix for CVE-2026-33039 (SSRF)Packagist · wwbn/avideo
- CVE-2026-40935WWBN/AVideo has CAPTCHA Bypass via Attacker-Controlled Length Parameter and Missing Token Invalidation on FailurePackagist · wwbn/avideo
- CVE-2026-40929WWBN AVideo's missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creatorsPackagist · wwbn/avideo
- CVE-2026-40928AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset DeletionPackagist · wwbn/avideo