Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-5739PowerJob OpenAPI Endpoint addWorkflowNode GroovyEvaluator.evaluate code injectionMaven · tech.powerjob:powerjob-server-starter
- CVE-2026-39365Vite has a Path Traversal in Optimized Deps `.map` Handlingnpm · vite · fixed in 8.0.5, 7.3.2, 6.4.2
- CVE-2026-39364Vite has a `server.fs.deny` bypass with queriesnpm · vite · fixed in 8.0.5, 7.3.2
- CVE-2026-39363Vite Affected by Arbitrary File Read via Vite Dev Server WebSocketnpm · vite · fixed in 8.0.5, 7.3.2, 6.4.2
- CVE-2026-39360RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltrationcrates.io · rustfs
- CVE-2026-5736PowerJob detailPlus Endpoint InstanceController.java sql injectionMaven · tech.powerjob:powerjob-server-starter
- CVE-2026-39324Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserializationRubyGems · rack-session · fixed in 2.1.2
- CVE-2026-39321Parse Server has a login timing side-channel reveals user existencenpm · parse-server · fixed in 9.8.0-alpha.6, 8.6.74
- CVE-2026-22680OpenViking < 0.3.3 Missing Authorization via Task PollingPyPI · openviking · fixed in 0.3.3
- CVE-2026-39307PraisonAI has an Arbitrary File Write (Zip Slip) in Templates ExtractionPyPI · praisonai · fixed in 4.5.113
- CVE-2026-39308PraisonAI recipe registry publish path traversal allows out-of-root file writePyPI · praisonai · fixed in 4.5.113
- CVE-2026-39306PraisonAI recipe registry pull path traversal writes files outside the chosen output directoryPyPI · praisonai · fixed in 4.5.113
- CVE-2026-39305Arbitrary File Write / Path Traversal in Action OrchestratorPyPI · praisonai · fixed in 4.5.113
- CVE-2026-35615PraisonAI has a Path Traversal in FileToolsPyPI · praisonai · fixed in 1.5.113
- CVE-2026-32588Apache Cassandra: Authenticated DoS via ALTER ROLE Password HashingMaven · org.apache.cassandra:cassandra-all · fixed in 4.0.20, 4.1.11, 5.0.7
- CVE-2026-27315Apache Cassandra: cqlsh history sensitive information leakMaven · org.apache.cassandra:cassandra-all · fixed in 4.0.20
- CVE-2026-35613Path traversal in coursevault-preview due to improper base-directory boundary validationnpm · coursevault-preview · fixed in 0.1.1
- CVE-2026-35611Addressable has a Regular Expression Denial of Service in Addressable templatesRubyGems · addressable · fixed in 2.9.0
- CVE-2026-27314Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypassMaven · org.apache.cassandra:cassandra-all · fixed in 5.0.7
- CVE-2026-35607File Browser: Proxy auth auto-provisioned users inherit Execute permission and CommandsGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.63.1
- CVE-2026-35606File Browser discloses text file content via /api/resources endpoint bypassing Perm.Download checkGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.63.1
- CVE-2026-35605File Browser has an access rule bypass via HasPrefix without trailing separator in path matchingGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.63.1
- CVE-2026-35604File Browser share links remain accessible after Share/Download permissions are revokedGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.63.1
- CVE-2026-35585File Browser has a Command Injection via Hook RunnerGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.33.8
- CVE-2026-35592pyLoad has an Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix BypassPyPI · pyload-ng · fixed in 0.5.0b3.dev97
- CVE-2026-35586Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ngPyPI · pyload-ng · fixed in 0.5.0b3.dev97
- CVE-2026-35523Authentication bypass in strawberry-graphql via legacy graphql-ws WebSocket subprotocolPyPI · strawberry-graphql · fixed in 0.312.3
- CVE-2026-35583Emissary has a Path Traversal via Blacklist Bypass in Configuration APIMaven · gov.nsa.emissary:emissary · fixed in 8.39.0
- CVE-2026-35581Emissary has a Command Injection via PLACE_NAME Configuration in ExecutrixMaven · gov.nsa.emissary:emissary · fixed in 8.39.0
- CVE-2026-35580Emissary has GitHub Actions Shell Injection via Workflow InputsMaven · gov.nsa.emissary:emissary · fixed in 8.39.0