Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-33212Weblate: Improper access control for pending tasks in APIPyPI · weblate · fixed in 5.17
- CVE-2026-6290Velociraptor Query() Plugin Misapplies Permissions To OrgsGo · www.velocidex.com/golang/velociraptor
- CVE-2026-5758Mafintosh's protocol-buffers-schema is vulnerable to prototype pollutionnpm · protocol-buffers-schema · fixed in 3.6.1
- CVE-2026-25219Apache Airflow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view accessPyPI · apache-airflow, apache-airflow-core · fixed in 3.0.0, 3.1.8
- CVE-2026-3590Race Condition in Guest Magic Link Authentication Allows Token ReuseGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.13+incompatible, 11.3.3+incompatible, 11.4.3+incompatible and more
- CVE-2026-30778Apache SkyWalking: The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL.Maven · org.apache.skywalking:server-core · fixed in 10.4.0
- CVE-2026-28741CSRF Protection Bypass Allows Updating a User's Authentication MethodGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 11.3.3+incompatible, 11.4.3+incompatible, 11.5.0+incompatible and more
- CVE-2026-33805@fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headersnpm · @fastify/http-proxy, @fastify/reply-from · fixed in 11.4.4, 12.6.2
- CVE-2026-27769Connected Workspaces: Malicious remote server can manipulate arbitrary user's statusGo · github.com/mattermost/mattermost-server · fixed in 8.0.0-20260316060126-bc1a2b34b1f9
- CVE-2026-33807@fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopesnpm · @fastify/express · fixed in 4.0.5
- CVE-2026-33808@fastify/express vulnerable to middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)npm · @fastify/express · fixed in 4.0.5
- CVE-2026-3505Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.Maven · org.bouncycastle:bcpg-jdk12, org.bouncycastle:bcpg-jdk14 +5 · fixed in 1.84
- CVE-2026-5588PKIX draft CompositeVerifier accepts empty signature sequence as valid.Maven · org.bouncycastle:bcpkix-debug-jdk14, org.bouncycastle:bcpkix-debug-jdk15to18 +5 · fixed in 1.84
- CVE-2026-5598Non-constant time comparisons risk private key leakage in FrodoKEM.Maven · org.bouncycastle:bcprov-jdk14, org.bouncycastle:bcprov-jdk15to18 +1 · fixed in 1.84, 1.80.2
- CVE-2026-0636LDAP Injection Vulnerability in LDAPStoreHelper.javaMaven · org.bouncycastle:bcprov-jdk14, org.bouncycastle:bcprov-jdk15to18 +1 · fixed in 1.84
- CVE-2025-14813GOSTCTR implementation unable to process more than 255 blocks correctlyMaven · org.bouncycastle:bcprov-debug-jdk14, org.bouncycastle:bcprov-debug-jdk15on +12 · fixed in 1.84, 1.80.2, 1.81.1
- CVE-2026-5160Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting (XSS) due to improper orGo · github.com/yuin/goldmark, github.com/yuin/goldmark/renderer/html · fixed in 1.7.17
- CVE-2025-54550Apache Airflow: RCE by race condition in example_xcom dagPyPI · apache-airflow, apache-airflow-core · fixed in 3.0.0, 3.2.0
- CVE-2026-33806fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Headernpm · fastify · fixed in 5.3.2, 4.29.1, 5.8.5
- CVE-2026-40105XWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionalityMaven · org.xwiki.platform:xwiki-platform-web-templates · fixed in 16.10.16, 17.4.8, 17.10.1
- CVE-2026-40104XWiki's REST APIs can list all pages/spaces, leading to unavailabilityMaven · org.xwiki.platform:xwiki-platform-legacy-oldcore, org.xwiki.platform:xwiki-platform-oldcore · fixed in 16.10.16, 17.4.8, 17.10.1
- CVE-2024-53412Command injection in the connect function in NietThijmen ShoppingCart 0.0.2 allows an attacker to execute arbitrary shell commands and achieGo · github.com/nietthijmen/shoppingcart
- CVE-2026-30625Upsonic 0.71.6 contains a remote code execution vulnerability in its MCP server/task creation functionality.PyPI · upsonic · fixed in 0.72.0
- CVE-2026-40091SpiceDB: SPICEDB_DATASTORE_CONN_URI is leaked on startup logsGo · github.com/authzed/spicedb · fixed in 1.51.1
- CVE-2026-40090Zarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File WriteGo · github.com/defenseunicorns/zarf, github.com/zarf-dev/zarf · fixed in 0.74.2
- CVE-2026-39984Sigstore Timestamp Authority has Improper Certificate Validation in verifierGo · github.com/sigstore/timestamp-authority, github.com/sigstore/timestamp-authority/v2 · fixed in 2.0.6
- CVE-2026-39971Serendipity: Host Header Injection leads to SMTP header injection via unvalidated HTTP_HOSTPackagist · s9y/serendipity · fixed in 2.6.0
- CVE-2026-39963Serendipity: Host Header Injection enables authentication cookie scoping to an attacker-controlled domainPackagist · s9y/serendipity · fixed in 2.6.0
- CVE-2026-39884MCP Server Kubernetes has Argument Injection in its port_forward tool via space-splittingnpm · mcp-server-kubernetes · fixed in 3.5.0
- GHSA-4X48-CGF9-Q33FNovu has SSRF via conditions filter webhook bypasses validateUrlSsrf() protectionnpm · @novu/api · fixed in 3.15.0