Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-40926WWBN AVideo Vulnerable to CSRF in Admin JSON Endpoints (Category CRUD, Plugin Update Script)Packagist · wwbn/avideo
- CVE-2026-40946Oxia: OIDC token audience validation bypass via SkipClientIDCheckGo · github.com/oxia-db/oxia · fixed in 0.16.2
- CVE-2026-40945Oxia: Bearer token exposed in debug log messages on authentication failureGo · github.com/oxia-db/oxia · fixed in 0.16.2
- CVE-2026-40944Oxia: TLS CA certificate chain validation fails with multi-certificate PEM bundlesGo · github.com/oxia-db/oxia · fixed in 0.16.2
- CVE-2026-40943Oxia: Server crash via race condition in session heartbeat handlingGo · github.com/oxia-db/oxia · fixed in 0.16.2
- CVE-2026-40942DSF: Inverted Time Comparison in OIDC JWKS and Token CacheMaven · dev.dsf:dsf-bpe-process-api-v2, dev.dsf:dsf-bpe-server
- CVE-2026-40939DSF: Missing Session Timeout for OIDC SessionsMaven · dev.dsf:dsf-bpe-server, dev.dsf:dsf-common-jetty +1
- CVE-2026-40933Flowise: Authenticated RCE Via MCP Adaptersnpm · flowise, flowise-components · fixed in 3.1.0
- CVE-2026-40931Complete Bypass of CVE-2026-24884 Patch via Git-Delivered Symlink Poisoning in compressingnpm · compressing · fixed in 2.1.1, 1.10.5
- CVE-2026-40923Tekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekton/ checkGo · github.com/tektoncd/pipeline · fixed in 1.0.2, 1.3.4, 1.6.2 and more
- CVE-2026-40924Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory ExhaustionGo · github.com/tektoncd/pipeline · fixed in 1.11.1, 1.0.2, 1.3.4 and more
- CVE-2026-40938Tekton Pipelines: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCEGo · github.com/tektoncd/pipeline · fixed in 1.0.2, 1.3.4, 1.6.2 and more
- CVE-2026-40910frp: Authentication bypass in frp HTTP vhost routing when routeByHTTPUser is used for access controlGo · github.com/fatedier/frp · fixed in 0.68.1
- CVE-2026-40895follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targetsnpm · follow-redirects · fixed in 1.16.0
- CVE-2026-40925WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP CredentialsPackagist · wwbn/avideo
- CVE-2026-40911WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() SinksPackagist · wwbn/avideo
- CVE-2026-40909WWBN AVideo has a Path Traversal in Locale Save Endpoint that Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)Packagist · wwbn/avideo
- CVE-2026-40908WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php that Exposes Developer Emails and Deployed VersionPackagist · wwbn/avideo
- CVE-2026-40890github.com/gomarkdown/markdown: Out-of-bounds Read in SmartypantsRendererGo · github.com/gomarkdown/markdown · fixed in 0.0.0-20260411013819-759bbc3e3207
- CVE-2026-40907WWBN AVideo has IDOR in Live Restreams list.json.php that Exposes Other Users' Stream Keys and OAuth TokensPackagist · wwbn/avideo
- CVE-2026-40885goshs: Public collaborator feed leaks .goshs ACL credentials and enables unauthorized accessGo · github.com/patrickhener/goshs, github.com/patrickhener/goshs/v2 · fixed in 2.0.0-beta.6
- CVE-2026-40884goshs: Empty-username SFTP password authentication bypass in goshsGo · github.com/patrickhener/goshs, github.com/patrickhener/goshs/v2 · fixed in 2.0.0
- CVE-2026-40883goshs: CSRF in state-changing GET routes enables authenticated file deletion and directory creationGo · github.com/patrickhener/goshs, github.com/patrickhener/goshs/v2 · fixed in 2.0.0-beta.6
- CVE-2026-40876SFTP root escape via prefix-based path validation in goshsGo · github.com/patrickhener/goshs, github.com/patrickhener/goshs/v2 · fixed in 2.0.0
- CVE-2026-40887@vendure/core has a SQL Injection vulnerabilitynpm · @vendure/core · fixed in 3.5.7, 3.6.2, 2.3.4
- CVE-2026-33812Excessive memory allocation when decoding malicious SFNT in golang.org/x/imageGo · golang.org/x/image · fixed in 0.39.0
- CVE-2026-33813Panic when decoding large WEBP image on 32-bit platforms in golang.org/x/imageGo · golang.org/x/image · fixed in 0.42.0
- CVE-2026-40881Zebra: addr/addrv2 Deserialization Resource Exhaustioncrates.io · zebra-network, zebrad · fixed in 5.0.1, 4.3.1
- CVE-2026-40372ASP.NET Core Elevation of Privilege VulnerabilityNuGet · microsoft.aspnetcore.dataprotection · fixed in 10.0.7
- CVE-2026-40880Zebra: Cached Mempool Verification Bypasses Consensus Rules for Ahead-of-Tip Blockscrates.io · zebra-consensus, zebrad · fixed in 5.0.2, 4.3.1