Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-6410@fastify/static vulnerable to path traversal in directory listingnpm · @fastify/static · fixed in 9.1.1
- CVE-2026-6414@fastify/static vulnerable to route guard bypass via encoded path separatorsnpm · @fastify/static · fixed in 9.1.1
- CVE-2026-31843goodoneuz/pay-uz Unauthenticated PHP File Overwrite via /payment/api/editable/update Leading to Remote Code ExecutionPackagist · goodoneuz/pay-uz · fixed in 3.0.0
- CVE-2026-40245Free5GC: UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authenticationGo · github.com/free5gc/udr
- CVE-2026-40193Maddy Mail Server: LDAP Filter Injection via Unsanitized UsernameGo · github.com/foxcpp/maddy · fixed in 0.9.3
- CVE-2026-40192Pillow is vulnerable to a FITS GZIP decompression bombPyPI · pillow · fixed in 12.2.0
- CVE-2026-39350Istio AuthorizationPolicy Incorrect Regex Matching of Dots in serviceAccounts Fields Allows Policy BypassGo · istio.io/istio · fixed in 0.0.0-20260403004500-692e460c342d
- CVE-2026-40179Prometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorerGo · github.com/prometheus/prometheus · fixed in 0.311.2-0.20260410083055-07c6232d159b, 3.5.2, 3.11.2
- CVE-2026-40261Composer has Command Injection via Malicious Perforce ReferencePackagist · composer/composer · fixed in 2.9.6, 2.2.27
- CVE-2026-40176Composer is vulnerable to Command Injection via Malicious Perforce RepositoryPackagist · composer/composer · fixed in 2.9.6, 2.2.27
- CVE-2026-40173Dgraph: Unauthenticated pprof endpoint leaks admin auth tokenGo · github.com/dgraph-io/dgraph, github.com/dgraph-io/dgraph/v24 +2 · fixed in 25.3.2, 24.1.9
- CVE-2026-40186ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elementsnpm · sanitize-html · fixed in 2.17.3
- CVE-2026-39857Information Disclosure via `choices`/`counts` Query Parameters Bypassing publicApiProjection Field Restrictionsnpm · apostrophe · fixed in 4.29.0
- CVE-2026-35569ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMSnpm · apostrophe · fixed in 4.29.0
- CVE-2026-33889ApostropheCMS: Stored XSS via CSS Custom Property Injection in `@apostrophecms/color-field` Escaping Style Tag Contextnpm · apostrophe · fixed in 4.29.0
- CVE-2026-33888ApostropheCMS: publicApiProjection Bypass via `project` Query Builder in Piece-Type REST APInpm · apostrophe · fixed in 4.29.0
- CVE-2026-21726Loki Path Traversal - CVE-2021-36156 BypassGo · github.com/grafana/loki, github.com/grafana/loki/v3 · fixed in 3.6.4
- CVE-2025-41118Sensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protectionGo · github.com/grafana/pyroscope · fixed in 1.15.2, 1.16.1
- CVE-2026-33877ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpointnpm · apostrophe · fixed in 4.29.0
- CVE-2026-21727Grafana Correlations: Cross-Tenant Data Disclosure and Permanent Deletion via Legacy org_id=0 RecordGo · github.com/grafana/grafana · fixed in 1.9.2-0.20260127141016-e702db6096e0
- CVE-2026-40256Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix CollisionPyPI · weblate · fixed in 5.17
- CVE-2026-39845Weblate: SSRF via the webhook add-on using unprotected fetch_url()PyPI · weblate · fixed in 5.17
- CVE-2026-34393Weblate: Privilege escalation in the user API endpointPyPI · weblate · fixed in 5.17
- CVE-2026-34244Weblate: SSRF via Project-Level Machinery ConfigurationPyPI · weblate · fixed in 5.17
- CVE-2026-6383Kubevirt: kubevirt: unauthorized subresource access due to improper rbac evaluationGo · kubevirt.io/kubevirt
- CVE-2026-34242Weblate: Arbitrary File Read via SymlinkPyPI · weblate · fixed in 5.17
- CVE-2026-33440Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploadsPyPI · weblate · fixed in 5.17
- CVE-2026-33435Weblate: Remote code execution during backup restorationPyPI · weblate · fixed in 5.17
- CVE-2026-33220Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repositoryPyPI · weblate · fixed in 5.17
- CVE-2026-33214Weblate has improper access control for the translation memory APIPyPI · weblate · fixed in 5.17