Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-56015In GenieACS 1.2.13, an unauthenticated access vulnerability exists in the NBI API endpoint.npm · genieacs
- CVE-2025-70844yaffa v2.0.0 is vulnerable to Cross Site Scripting (XSS).Packagist · kantorge/yaffa
- CVE-2026-35454Code Extension Marketplace has a Zip Slip Path TraversalGo · github.com/coder/code-marketplace · fixed in 1.2.3-0.20260402184705-988440dee05f
- CVE-2026-35452WWBN AVideo has Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.phpPackagist · wwbn/avideo
- CVE-2026-35450WWBN AVideo has Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.phpPackagist · wwbn/avideo
- CVE-2026-35449WWBN AVideo has Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.phpPackagist · wwbn/avideo
- CVE-2026-35448WWBN AVideo Provides Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.phpPackagist · wwbn/avideo
- CVE-2026-35471Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshsGo · github.com/patrickhener/goshs · fixed in 1.1.5-0.20260401172448-237f3af891a9
- CVE-2026-35442Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queriesnpm · directus · fixed in 11.17.0
- CVE-2026-35441Directus Affected by GraphQL Alias Amplification Denial-of-Service Due to Missing Query Cost/Complexity Limitsnpm · directus · fixed in 11.17.0
- CVE-2026-35413Directus GraphQL Schema SDL Disclosure Settingnpm · directus · fixed in 11.16.1
- CVE-2026-35412Directus has a TUS Upload Authorization Bypass Allows Arbitrary File Overwritenpm · directus · fixed in 11.16.1
- CVE-2026-35411Directus is an Open Redirect in Admin 2FA Setup Pagenpm · directus · fixed in 11.16.1
- CVE-2026-35410Directus has an Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flownpm · directus · fixed in 11.16.1
- CVE-2026-35409Directus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Importnpm · directus · fixed in 11.16.0
- CVE-2026-35408Directus is Missing Cross-Origin Opener Policynpm · directus · fixed in 11.17.0
- CVE-2026-35394Mobile Next has Arbitrary Android Intent Execution via mobile_open_urlnpm · @mobilenext/mobile-mcp · fixed in 0.0.50
- CVE-2026-35393Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart uploadGo · github.com/patrickhener/goshs · fixed in 1.1.5-0.20260401172448-237f3af891a9
- CVE-2026-35392goshs has an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT UploadGo · github.com/patrickhener/goshs · fixed in 1.1.5-0.20260401172448-237f3af891a9
- CVE-2026-34972OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collisionGo · github.com/openfga/openfga · fixed in 1.14.0
- CVE-2026-35213Regular Expression Denial of Service (ReDoS) in @hapi/content HTTP header parsingnpm · @hapi/content · fixed in 6.0.1
- CVE-2026-35201Discount has an Out-of-bounds Read in rdiscountRubyGems · rdiscount · fixed in 2.2.7.4
- CVE-2026-35200Parse Server has a file upload Content-Type override via extension mismatchnpm · parse-server · fixed in 9.7.1-alpha.4, 8.6.73
- CVE-2026-35459pyLoad has SSRF fix bypass via HTTP redirectPyPI · pyload-ng
- CVE-2026-35187pyLoad has SSRF in parse_urls API endpoint via unvalidated URL parameterPyPI · pyload-ng
- CVE-2026-35181WWBN AVideo Affected by CSRF on Player Skin Configuration via admin/playerUpdate.json.phpPackagist · wwbn/avideo
- CVE-2026-35172Distribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidationGo · github.com/distribution/distribution, github.com/distribution/distribution/v3 · fixed in 3.1.0
- CVE-2026-35179WWBN AVideo Unauthenticated Instagram Graph API Proxy via publishInstagram.json.phpPackagist · wwbn/avideo
- CVE-2026-35175Ajenti has an authorization bypass during custom package installationPyPI · ajenti-panel · fixed in 2.2.15
- CVE-2026-35171Arbitrary Code Execution via Malicious Logging Configuration in KedroPyPI · kedro · fixed in 1.3.0