Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-35167Kedro has a path traversal in versioned dataset loading via unsanitized version stringPyPI · kedro · fixed in 1.3.0
- CVE-2026-35470OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe ModalsPackagist · devcode-it/openstamanager · fixed in 2.10.2
- CVE-2026-35166Hugo does not properly escape some Markdown linksGo · github.com/gohugoio/hugo · fixed in 0.159.2
- CVE-2026-35052D-Tale affected by Remote Code Execution through redis/shelf storagePyPI · dtale · fixed in 3.22.0
- CVE-2026-35209defu: Prototype pollution via `__proto__` key in defaults argumentnpm · defu · fixed in 6.1.5
- CVE-2026-35044BentoML has a Server-Side Template Injection via unsandboxed Jinja2 Environment in Dockerfile generationPyPI · bentoml · fixed in 1.4.38
- CVE-2026-35043BentoML: command injection in cloud deployment setup script (deployment.py)PyPI · bentoml · fixed in 1.4.38
- CVE-2026-35042fast-jwt accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)npm · fast-jwt
- CVE-2026-35039fast-jwt Affected by Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)npm · fast-jwt · fixed in 6.2.0
- CVE-2026-35037Ech0 affected by unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadataGo · github.com/lin-snow/ech0 · fixed in 1.4.8-0.20260401031029-4ca56fea5ba4
- CVE-2026-35036Ech0 Affected by Unauthenticated Server-Side Request Forgery in Website Preview FeatureGo · github.com/lin-snow/ech0 · fixed in 1.4.8-0.20260401031029-4ca56fea5ba4
- CVE-2026-35035CI4MS Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company Information Stored DOM XSSPackagist · ci4-cms-erp/ci4ms · fixed in 0.31.2.0
- CVE-2026-35030LiteLLM has an authentication bypass via OIDC userinfo cache key collisionPyPI · litellm · fixed in 1.83.0
- CVE-2026-35029LiteLLM affected by privilege escalation via unrestricted proxy configuration endpointPyPI · litellm · fixed in 1.83.0
- CVE-2026-34992Missing Encryption of Sensitive Data in antrea.io/antreaGo · antrea.io/antrea · fixed in 1.11.0-alpha.0.0.20260225185322-738bad662b20
- CVE-2026-34989CI4MS affected by Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSPackagist · ci4-cms-erp/ci4ms · fixed in 31.0.0.0
- CVE-2026-34986Go JOSE affect by a panic in JWE decryptionGo · github.com/go-jose/go-jose, github.com/go-jose/go-jose/v3 +1 · fixed in 3.0.5, 4.1.4
- CVE-2026-34976Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing AuthorizationGo · github.com/dgraph-io/dgraph, github.com/dgraph-io/dgraph/v24 +2 · fixed in 25.3.1, 24.1.6
- CVE-2026-34841Axios npm Supply Chain Incident Impacting @usebruno/clinpm · @usebruno/cli · fixed in 3.2.1
- CVE-2026-34783Ferret has a Path Traversal in IO::FS::WRITE allows arbitrary file write when scraping malicious websitesGo · github.com/montferret/ferret, github.com/montferret/ferret/v2 · fixed in 2.0.0-alpha.4
- CVE-2026-34969Nhost Leaks the Refresh Token via URL Query Parameter in OAuth Provider CallbackGo · github.com/nhost/nhost · fixed in 0.0.0-20260330133707-294954e0fc3a
- CVE-2026-34950fast-jwt has an incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Keynpm · fast-jwt · fixed in 6.2.0
- CVE-2026-34940KubeAI has an OS Command Injection via Model URL in Ollama Engine startup probe allows arbitrary command execution in model podsGo · github.com/kubeai-project/kubeai · fixed in 0.23.2
- CVE-2026-34764Electron has a use-after-free in offscreen shared texture release() callbacknpm · electron · fixed in 39.8.5, 40.8.5, 41.1.0 and more
- CVE-2026-34756vLLM Affected by Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API ServerPyPI · vllm · fixed in 0.19.0
- CVE-2026-34755vLLM Affected by Denial of Service via Unbounded Frame Count in video/jpeg Base64 ProcessingPyPI · vllm · fixed in 0.19.0
- CVE-2026-34753vLLM affected by Server-Side Request Forgery (SSRF) in `download_bytes_from_url `PyPI · vllm · fixed in 0.19.0
- CVE-2026-34589OpenEXR: DWA Lossy Decoder Heap Out-of-Bounds WritePyPI · openexr · fixed in 3.2.7, 3.3.9, 3.4.9
- CVE-2026-34588OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/WritePyPI · openexr · fixed in 3.2.7, 3.3.9, 3.4.9
- CVE-2026-34444Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattrPyPI · lupa