Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-39429kcp's cache server is accessible without authentication or authorization checksGo · github.com/kcp-dev/kcp · fixed in 0.29.3, 0.30.3
- CVE-2026-39844NiceGUI has a Path Traversal in NiceGUI Upload Filename on Windows via Backslash Bypass of PurePosixPath SanitizationPyPI · nicegui · fixed in 3.10.0
- CVE-2026-39414MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV ParsingGo · github.com/minio/minio
- CVE-2026-39859LiquidJS has a renderFile() / parseFile() bypass configured root and allow arbitrary file readnpm · liquidjs · fixed in 10.25.5
- CVE-2026-39413LightRAG has a JWT Algorithm Confusion Vulnerability in LightRAG APIPyPI · lightrag-hku · fixed in 1.4.14
- CVE-2026-39412LiquidJS has an ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channelnpm · liquidjs · fixed in 10.25.4
- CVE-2026-39411LobeHub has an unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` headernpm · @lobehub/lobehub · fixed in 2.1.48
- CVE-2026-35525LiquidJS has a root restriction bypass for partial and layout loading through symlinked templatesnpm · liquidjs · fixed in 10.25.3
- CVE-2026-23869A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-servernpm · react-server-dom-parcel, react-server-dom-turbopack +1 · fixed in 19.0.5, 19.1.6, 19.2.5
- CVE-2026-34166LiquidJS has a Memory Limit Bypass via Quadratic Amplification in `replace` Filternpm · liquidjs · fixed in 10.25.3
- CVE-2026-27806Fleet Affected by Local Privilege Escalation via Tcl Command Injection in OrbitGo · github.com/fleetdm/fleet/v4 · fixed in 4.81.1
- CVE-2026-33753Improper Certificate Validation in rfc3161-clientPyPI · rfc3161-client · fixed in 1.0.6
- CVE-2026-33229XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting APIMaven · org.xwiki.platform:xwiki-platform-legacy-oldcore, org.xwiki.platform:xwiki-platform-oldcore · fixed in 17.4.8, 17.10.1
- CVE-2026-39410Hono has a non-breaking space prefix bypass in cookie name handling in getCookie()npm · hono · fixed in 4.12.12
- CVE-2026-39409Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addressesnpm · hono · fixed in 4.12.12
- CVE-2026-39408Hono has a path traversal in toSSG() allows writing files outside the output directorynpm · hono · fixed in 4.12.12
- CVE-2026-39407Hono has a middleware bypass via repeated slashes in serveStaticnpm · hono · fixed in 4.12.12
- CVE-2026-39406@hono/node-server has a middleware bypass via repeated slashes in serveStaticnpm · @hono/node-server · fixed in 1.19.13
- CVE-2026-39394CI4MS has an .env CRLF Injection via Unvalidated `host` Parameter in Install ControllerPackagist · ci4-cms-erp/ci4ms · fixed in 0.31.4.0
- CVE-2026-39393Post-Installation Re-entry via Cache-Dependent Install Guard Bypass in ci4msPackagist · ci4-cms-erp/ci4ms · fixed in 0.31.4.0
- CVE-2026-39392CI4MS has Stored XSS in Pages Content Due to Missing html_purify SanitizationPackagist · ci4-cms-erp/ci4ms · fixed in 0.31.4.0
- CVE-2026-39391CI4MS has Stored XSS via Unescaped Blacklist Note in Admin User ListPackagist · ci4-cms-erp/ci4ms · fixed in 0.31.4.0
- CVE-2026-39390CI4MS has Stored XSS via srcdoc attribute bypass in Google Maps iframe settingPackagist · ci4-cms-erp/ci4ms · fixed in 0.31.4.0
- CVE-2026-39389CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected FilesPackagist · ci4-cms-erp/ci4ms · fixed in 0.31.4.0
- CVE-2026-39865Axios HTTP/2 Session Cleanup State Corruption Vulnerabilitynpm · axios · fixed in 1.13.2
- CVE-2026-5795In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.Maven · org.eclipse.jetty.ee10:jetty-ee10-jaspi, org.eclipse.jetty.ee11:jetty-ee11-jaspi +3 · fixed in 12.1.8, 12.0.34, 11.0.29 and more
- CVE-2026-5600A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific event in fact returns all check-PyPI · pretix · fixed in 2026.1.2, 2026.2.1, 2026.3.1
- CVE-2026-1163Insufficient Session Expiration in parisneo/lollmsPyPI · lollms
- CVE-2026-32280Unexpected work during chain building in crypto/x509Go · stdlib · fixed in 1.25.9, 1.26.2
- CVE-2026-32281Inefficient policy validation in crypto/x509Go · stdlib · fixed in 1.25.9, 1.26.2