Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-108260@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSSnpm · @tinacms/web-components · fixed in 0.2.1
- CVE-2026-108259Tina: Code injection via unescaped Git branch name in generated client sourcenpm · @tinacms/cli · fixed in 3.0.0
- CVE-2026-108258Shiny for Python - Path traversal in bookmark restorePyPI · shiny · fixed in 1.6.4
- CVE-2026-107851Contao: Improper access control in the table access voterPackagist · contao/core-bundle · fixed in 5.7.12
- CVE-2026-107850Contao: Improper access control in the preview links modulePackagist · contao/core-bundle · fixed in 5.7.12
- CVE-2026-107848Contao: Cross-site request forgery in custom backend actionsPackagist · contao/core-bundle · fixed in 5.3.50, 5.7.12
- CVE-2026-107845Contao: Cross-site scripting in the comments bundlePackagist · contao/comments-bundle · fixed in 5.3.50, 5.7.12
- CVE-2026-107844Contao: Path traversal in the images controllerPackagist · contao/core-bundle · fixed in 5.3.50, 5.7.12
- CVE-2026-107843Contao: The registration module re-sends activation mails on any unauthenticated POST, with no throttle and no captcha checkPackagist · contao/core-bundle · fixed in 5.3.50, 5.7.12
- CVE-2026-107842Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabledPackagist · contao/core-bundle · fixed in 5.3.50, 5.7.12
- CVE-2026-107841pacioli: A submit consent marker licensed cancellation of caller-named pre-existing documentsPyPI · pacioli-guard · fixed in 0.10.0
- CVE-2026-107840yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labelsGo · github.com/jhaals/yopass · fixed in 0.0.0-20260727191436-61e31ead04a4
- CVE-2026-107839ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of ServiceGo · github.com/luskaner/agelanserver/server · fixed in 1.8.2-0.20260809203301-1dd40166a593
- CVE-2026-107835OWASP Coraza WAF: Cookie Parser ConfusionGo · github.com/corazawaf/coraza, github.com/corazawaf/coraza/v2 +1 · fixed in 3.8.1
- CVE-2026-107834OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processorGo · github.com/corazawaf/coraza, github.com/corazawaf/coraza/v2 +1 · fixed in 3.8.0
- CVE-2026-107833OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustionGo · github.com/corazawaf/coraza, github.com/corazawaf/coraza/v2 +1 · fixed in 3.8.0
- CVE-2026-107826OWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)Go · github.com/corazawaf/coraza, github.com/corazawaf/coraza/v2 +1 · fixed in 3.8.1
- CVE-2026-107825OWASP Coraza WAF: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrationsGo · github.com/corazawaf/coraza, github.com/corazawaf/coraza/v2 +1 · fixed in 3.8.0
- GHSA-R44W-V6GF-X3P6pyLoad has an authentication bypass in API key validation (check_apikey cache)PyPI · pyload-ng · fixed in 0.5.0b3.dev101
- CVE-2026-55797Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URLGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 +1 · fixed in 3.3.15, 3.4.10, 3.5.4 and more
- CVE-2026-75597pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typoPyPI · pyload-ng · fixed in 0.5.0b3.dev101
- CVE-2026-48484pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process TerminationPyPI · pyload-ng · fixed in 0.5.0b3.dev101
- CVE-2026-107813Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-upGo · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260728074433-a3999bd78a3b
- CVE-2026-107812Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITMGo · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260728114330-580585516dd8
- CVE-2026-1078110xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUserGo · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260728091109-0ecbd106c37b
- CVE-2026-107810Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are appliedGo · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260728074146-a467ed652591
- CVE-2026-107809Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIsGo · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260728074433-a3999bd78a3b
- CVE-2026-107808Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)Go · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260728074558-95cd21b70814
- CVE-2026-102554Denial of Service via Eager Array Allocation During Deserialization in GuavaMaven · com.google.guava:guava · fixed in 33.7.2
- CVE-2026-107807Nginx UI: Node Secret Credential Exposure via URL Query ParameterGo · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260728074433-a3999bd78a3b