Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-107222Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil checkGo · github.com/xuri/excelize/v2 · fixed in 2.11.1-0.20260812075026-be7a16390fa6
- CVE-2026-107221Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read APIGo · github.com/xuri/excelize/v2 · fixed in 2.11.1-0.20260816084418-46a5eb289448
- CVE-2026-107220Excelize: Panic in cellInRange on a worksheet with an empty mergeCell refGo · github.com/xuri/excelize/v2 · fixed in 2.11.1-0.20260820023833-99903a3240e5
- CVE-2026-107219Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFileGo · github.com/xuri/excelize/v2 · fixed in 2.11.1-0.20260906004932-2badfcd5841d
- CVE-2026-107218Excelize: RIGHT() on supplementary-plane text slices with a negative index and panicsGo · github.com/xuri/excelize/v2 · fixed in 2.11.1-0.20260908032718-ecd99d761fe0
- CVE-2026-107217Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rowsGo · github.com/xuri/excelize, github.com/xuri/excelize/v2 · fixed in 2.11.1-0.20260910071107-696050fbf14e
- CVE-2026-107216Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflowGo · github.com/xuri/excelize/v2 · fixed in 2.11.1-0.20260911060113-ea12859e43c6
- CVE-2026-107215Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoSGo · github.com/360entsecgroup-skylar/excelize/v2, github.com/xuri/excelize/v2 · fixed in 2.11.1-0.20260912113515-5f636f9dcde5
- CVE-2026-56851Panic parsing crafted input in x/text/secure/precis in golang.org/x/textGo · golang.org/x/text · fixed in 0.41.0
- CVE-2026-107214Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooksGo · github.com/360entsecgroup-skylar/excelize/v2, github.com/xuri/excelize/v2 · fixed in 2.11.1-0.20260915055537-22f76f9acb94
- CVE-2026-107213Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing elementGo · github.com/xuri/excelize/v2 · fixed in 2.11.1-0.20260929015830-8ffeb07ec9a3
- CVE-2026-107212Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for daysGo · github.com/360entsecgroup-skylar/excelize/v2, github.com/xuri/excelize/v2 · fixed in 2.11.1-0.20260930021559-01a9ff32fb3c
- CVE-2026-107211Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panicGo · github.com/xuri/excelize/v2 · fixed in 2.11.1-0.20261003002531-6258dcebc4e2
- CVE-2026-106557Backstage: Improper input validation in TechDocs Markdown extension configurationnpm · @backstage/plugin-techdocs-node · fixed in 1.15.4
- CVE-2026-62252Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First LoginGo · github.com/sipcapture/homer-app · fixed in 0.0.0-20260625091610-b2e942031ff8
- CVE-2026-62253Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)Go · github.com/sipcapture/homer-app · fixed in 0.0.0-20260625093330-5e90809657c9
- CVE-2026-62251Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/queryGo · github.com/sipcapture/homer-app · fixed in 0.0.0-20260625085520-a7d027dc684b
- CVE-2026-62176PraisonAI: Code Injection via f-string Interpolation in Deploy API Server GenerationPyPI · praisonai · fixed in 4.6.78
- CVE-2026-106563Backstage: Improper entity validation in deprecated Kubernetes services endpointnpm · @backstage/plugin-kubernetes-backend · fixed in 0.21.8
- CVE-2026-106562Backstage: Incorrect authorization in search engine permission filteringnpm · @backstage/plugin-search-backend, @backstage/plugin-search-backend-module-elasticsearch · fixed in 2.1.6, 1.8.7
- CVE-2026-106561Backstage: Sensitive information disclosure in Kubernetes resource queriesnpm · @backstage/plugin-kubernetes-backend · fixed in 0.21.9
- CVE-2026-106560Backstage: Improper repository path validation in a Scaffolder backend modulenpm · @backstage/plugin-scaffolder-backend-module-confluence-to-markdown · fixed in 0.3.25
- CVE-2026-106559Backstage: Improper input validation in Confluence to Markdown scaffolder modulenpm · @backstage/plugin-scaffolder-backend-module-confluence-to-markdown · fixed in 0.3.25
- CVE-2026-106558Backstage: Improper validation of TechDocs MkDocs configurationnpm · @backstage/plugin-techdocs-node · fixed in 1.15.4
- CVE-2026-106510Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.ymlnpm · @backstage/plugin-techdocs-node · fixed in 1.15.4
- CVE-2026-62179PraisonAI: Platform members can delete owner issue dependencies through member-owned related issuesPyPI · praisonai-platform · fixed in 0.1.9
- CVE-2026-46438wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entryPyPI · wger
- CVE-2026-46437wger: API credentials remain valid after logout/password changePyPI · wger
- CVE-2026-46434wger: Trainer Privilege Escalation - Improper Privilege ManagementPyPI · wger
- CVE-2026-45161wger: trainer_login accepts GET - CSRF bypass enables forced session rebindingPyPI · wger