Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-39842OpenRemote is Vulnerable to Expression InjectionMaven · io.openremote:openremote-manager · fixed in 1.22.0
- CVE-2026-33414PowerShell Command Injection in Podman HyperV MachineGo · github.com/containers/podman, github.com/containers/podman/v2 +3 · fixed in 5.8.2
- CVE-2026-34457OAuth2 Proxy: Health Check User-Agent Matching Bypasses Authentication in auth_request ModeGo · github.com/oauth2-proxy/oauth2-proxy, github.com/oauth2-proxy/oauth2-proxy/v7 · fixed in 7.15.2
- CVE-2026-34454OAuth2 Proxy: Session cookie not cleared when rendering sign-in pageGo · github.com/oauth2-proxy/oauth2-proxy, github.com/oauth2-proxy/oauth2-proxy/v7 · fixed in 7.15.2
- CVE-2026-25133October CMS has Stored XSS via SVG Filter BypassPackagist · october/rain · fixed in 4.1.10, 3.7.14
- CVE-2026-25125October CMS: Environment Variable Exfiltration via INI Parser InterpolationPackagist · october/rain · fixed in 4.1.10, 3.7.14
- CVE-2026-40683In OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute to a boolean when the user_enablePyPI · keystone · fixed in 28.0.1
- CVE-2026-24907October CMS has Stored XSS via Event Log Mail PreviewPackagist · october/system · fixed in 4.1.10, 3.7.14
- CVE-2026-24906October CMS has Stored XSS in its Backend Editor Markup ClassesPackagist · october/system · fixed in 4.1.10, 3.7.14
- CVE-2026-32203.NET and Visual Studio Denial of Service VulnerabilityNuGet · system.security.cryptography.xml · fixed in 10.0.6, 9.0.15, 8.0.3
- CVE-2026-26171.NET Denial of Service VulnerabilityNuGet · system.security.cryptography.xml · fixed in 10.0.6, 9.0.15, 8.0.3
- CVE-2026-33116.NET, .NET Framework, and Visual Studio Denial of Service VulnerabilityNuGet · system.security.cryptography.xml · fixed in 10.0.6, 9.0.15, 8.0.3
- CVE-2026-32178.NET Spoofing VulnerabilityNuGet · microsoft.netcore.app.runtime.linux-arm, microsoft.netcore.app.runtime.linux-arm64 +10 · fixed in 10.0.6, 9.0.15, 8.0.26
- CVE-2026-22692October CMS: Twig Sandbox Bypass via Collection MethodsPackagist · october/rain · fixed in 4.1.5, 3.7.13
- CVE-2026-37980Org.keycloak.forms.login: keycloak: keycloak: arbitrary code execution via stored cross-site scripting (xss) in organization selection login pageMaven · org.keycloak:keycloak-services
- CVE-2026-2332HTTP Request Smuggling via Chunked Extension Quoted-String ParsingMaven · org.eclipse.jetty:jetty-http · fixed in 12.1.7, 12.0.33, 11.0.29 and more
- CVE-2025-13822Authentication bypass in MCPHubnpm · @samanhappy/mcphub · fixed in 0.11.0
- CVE-2026-33929Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example CodeMaven · org.apache.pdfbox:pdfbox-examples · fixed in 2.0.37, 3.0.8
- CVE-2026-40289PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessionsPyPI · praisonai, praisonaiagents · fixed in 4.5.139, 1.5.140
- CVE-2026-40288PraisonAI: Critical RCE via `type: job` workflow YAMLPyPI · praisonai, praisonaiagents · fixed in 4.5.139, 1.5.140
- CVE-2026-40287PraisonAI has RCE via Automatic tools.py ImportPyPI · praisonai, praisonaiagents · fixed in 4.5.139, 1.5.140
- CVE-2026-40315PraisonAI: SQLiteConversationStore didn't validate table_prefix when constructing SQL queriesPyPI · praisonai · fixed in 4.5.133
- CVE-2026-34984External Secrets Operator has DNS exfiltration via getHostByName in its v2 template engineGo · github.com/external-secrets/external-secrets · fixed in 1.3.3-0.20260331202714-6800989bdc12
- CVE-2026-34225Open WebUI has Blind Server Side Request Forgery in its Image Edit FunctionalityPyPI · open-webui
- CVE-2025-61260A vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context…npm · @openai/codex
- CVE-2026-38527A Server-Side Request Forgery (SSRF) in the /settings/webhooks/create component of Webkul Krayin CRM v2.2.x allows attackers to scan internaPackagist · krayin/laravel-crm
- CVE-2026-38529A Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attPackagist · krayin/laravel-crm
- CVE-2026-38530A Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticPackagist · krayin/laravel-crm
- CVE-2026-38532A Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php endpoint of Webkul Krayin CRM v2.2.x allows authentiPackagist · krayin/laravel-crm
- CVE-2026-34069nimiq-consensus panics via RequestMacroChain micro-block locatorcrates.io · nimiq-consensus