Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-40879Nest: DoS via Recursive handleData in JsonSocket (TCP Transport)npm · @nestjs/microservices · fixed in 11.1.19
- CVE-2026-40869Decidim amendments can be accepted or rejected by anyoneRubyGems · decidim-core · fixed in 0.31.1, 0.30.5
- CVE-2026-22751Spring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessionsMaven · org.springframework.security:spring-security-core · fixed in 6.5.10, 7.0.5
- CVE-2026-6745Bagisto Custom Scripts cross site scriptingPackagist · bagisto/bagisto
- CVE-2026-40868kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount tokenGo · github.com/kyverno/kyverno · fixed in 1.17.0
- CVE-2026-6744Bagisto Downloadable Link copy server-side request forgeryPackagist · bagisto/bagisto
- CVE-2026-40611Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 ProviderGo · github.com/go-acme/lego, github.com/go-acme/lego/v3 +1 · fixed in 4.34.0
- CVE-2026-40606ProxyAuth Addon LDAP Injection in mitmproxyPyPI · mitmproxy · fixed in 12.2.2
- CVE-2026-40602hass-cli: Handling of user-supplied Jinja2 templatesPyPI · homeassistant-cli · fixed in 1.0.0
- CVE-2026-40594pyLoad: Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)PyPI · pyload-ng · fixed in 0.5.0b3.dev98, 0.5.0b3.dev69
- CVE-2026-40576Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in excel-mcp-serverPyPI · excel-mcp-server · fixed in 0.1.8
- CVE-2026-40574OAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email ClaimsGo · github.com/oauth2-proxy/oauth2-proxy, github.com/oauth2-proxy/oauth2-proxy/v7 · fixed in 7.15.2
- CVE-2026-40161Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURLGo · github.com/tektoncd/pipeline · fixed in 1.0.2, 1.3.4, 1.6.2 and more
- CVE-2026-29179October: Editor Sub-Permission Bypass for Asset and Blueprint File OperationsPackagist · october/system · fixed in 4.1.16, 3.7.16
- CVE-2026-27937October: Reflected XSS via DataTable Form WidgetPackagist · october/system · fixed in 3.7.16
- CVE-2026-26274October: Safe Mode Bypass via Twig Database Write OperationsPackagist · october/october · fixed in 3.7.14, 4.1.10
- CVE-2026-26067October: Safe Mode Bypass via CSS Preprocessor CompilersPackagist · october/system · fixed in 3.7.14, 4.1.10
- CVE-2026-25542Tekton Pipelines: VerificationPolicy regex pattern bypass via substring matchingGo · github.com/tektoncd/pipeline · fixed in 1.0.2, 1.3.4, 1.6.2 and more
- CVE-2026-6553TYPO3 CMS Stores Cleartext Password in User Settings ModulePackagist · typo3/cms-backend · fixed in 14.3.0
- CVE-2026-39973Apktool: Path Traversal to Arbitrary File WriteMaven · org.apktool:apktool-lib · fixed in 3.0.2
- CVE-2026-39861Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspacenpm · @anthropic-ai/claude-code · fixed in 2.1.64
- CVE-2026-39386Neko has Self-service Privilege Escalation for Authenticated UsersGo · github.com/m1k1o/neko/server · fixed in 0.0.0-20260406184107-c54bcf1ee211, 3.0.11
- CVE-2026-40264OpenBao's Token Store Allows Cross-Namespace Renewal, RevocationGo · github.com/openbao/openbao · fixed in 0.0.0-20260420162526-f58111d2ca54
- CVE-2026-39396OpenBao has Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS)Go · github.com/openbao/openbao · fixed in 0.0.0-20260420180337-2b2a901aa9f7
- CVE-2026-39388OpenBao's Certificate Authentication Allows Token Renewal With Different CertificateGo · github.com/openbao/openbao · fixed in 0.0.0-20260420160924-abe84e1af4c3
- CVE-2026-39946OpenBao allows SQL Injection in PostgreSQL database secrets engineGo · github.com/openbao/openbao · fixed in 0.0.0-20260420155735-b596b0882620
- CVE-2026-39378nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image EmbeddingPyPI · nbconvert · fixed in 7.17.1
- CVE-2026-39377nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment FilenamesPyPI · nbconvert · fixed in 7.17.1
- CVE-2026-39320Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Pathsnpm · signalk-server · fixed in 2.25.0
- CVE-2026-31018In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to Packagist · dolibarr/dolibarr