Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-84320Nginx UI: Auto backup name allows path traversal outside validated storage pathGo · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260715121709-f92218e01054
- CVE-2026-84318Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCEGo · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260703131214-23d1934099b0
- CVE-2026-106495Backstage: Improper access control in backend action invocationnpm · @backstage/backend-defaults · fixed in 0.17.8
- CVE-2026-84315Nginx UI OTP secure-session step-up is missing on sensitive mutation routesGo · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260703131214-23d1934099b0
- CVE-2026-41508OWASP Coraza WAF: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handlingGo · github.com/corazawaf/coraza, github.com/corazawaf/coraza/v2 +1 · fixed in 3.8.0
- CVE-2026-41504OWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via request body and header fieldsGo · github.com/corazawaf/coraza, github.com/corazawaf/coraza/v2 +1 · fixed in 3.8.0
- CVE-2026-104774OWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF BypassGo · github.com/corazawaf/coraza, github.com/corazawaf/coraza/v2 +1 · fixed in 3.8.0
- CVE-2026-41510OWASP Coraza WAF: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter floodingGo · github.com/corazawaf/coraza, github.com/corazawaf/coraza/v2 +1 · fixed in 3.8.1
- CVE-2026-95838containerd: Unpack DoS via repeated opaque whiteoutsGo · github.com/containerd/containerd, github.com/containerd/containerd/v2 · fixed in 1.7.35, 2.0.12, 2.2.8 and more
- CVE-2026-95837containerd CRI plugin: Checkpoint restore bypasses destination security contextGo · github.com/containerd/containerd, github.com/containerd/containerd/v2 · fixed in 2.2.7, 2.3.4
- CVE-2026-65954PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()Packagist · phpcsstandards/phpcsutils · fixed in 1.2.3
- CVE-2026-102663OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve SearchGo · github.com/openlistteam/openlist, github.com/openlistteam/openlist/v3 +1 · fixed in 4.2.4
- CVE-2026-57118PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpointsPyPI · praisonaiagents · fixed in 1.6.59
- CVE-2026-57143PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameterPyPI · praisonaiagents · fixed in 1.6.61
- CVE-2026-107226AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPSMaven · org.asynchttpclient:async-http-client · fixed in 3.0.14
- CVE-2026-104102copyparty FTP: upload outside defined volumes (limited path traversal)PyPI · copyparty · fixed in 1.20.19
- CVE-2026-77366obsidian-tc tokens can access arbitrary configured vaultsnpm · obsidian-tc · fixed in 1.3.1
- CVE-2026-77364obsidian-tc fail-open default ACL exposes Obsidian control-directory secretsnpm · obsidian-tc · fixed in 1.3.1
- CVE-2026-77363obsidian-tc Streamable HTTP transport permits cross-origin loopback vault accessnpm · obsidian-tc · fixed in 1.3.1
- CVE-2026-105274hex_core decompresses registry and Erlang term API responses without size limitsHex · hex_core · fixed in 0.20.0
- CVE-2026-109346better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /devicenpm · better-auth · fixed in 1.7.0-rc.3
- CVE-2026-109345DOMPurify before 3.4.16 XSS via IN_PLACE Returned Rawtext Rootnpm · dompurify · fixed in 3.4.16
- CVE-2026-109344DOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE afterSanitize Hooksnpm · dompurify · fixed in 3.4.16
- CVE-2026-103502hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25Hex · hex_core · fixed in 0.20.0
- CVE-2026-105283Internal error terms inspected into AshTypescript RPC error responsesHex · ash_typescript · fixed in 0.19.1
- CVE-2026-97853Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoSHex · decimal · fixed in 3.1.2
- CVE-2026-62376Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read accessGo · code.vikunja.io/api · fixed in 2.4.0
- CVE-2026-62367Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeoverGo · code.vikunja.io/api · fixed in 2.4.0
- CVE-2026-57458Vikunja: Scoped API token can mint unrestricted OAuth session credentialsGo · code.vikunja.io/api · fixed in 2.4.0
- CVE-2026-108261TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragmentnpm · @tinacms/app, tinacms · fixed in 2.5.14, 3.14.0