Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-105680Ghost: Authorization Issue Allowed Author Role to Delete any Postnpm · ghost · fixed in 6.60.0
- CVE-2026-105679Ghost: Stored XSS via File Uploads on Local Storagenpm · ghost · fixed in 6.64.0
- CVE-2026-105678Ghost: Editors Could Promote Staff Users to Their Own Rolenpm · ghost · fixed in 6.64.0
- CVE-2026-94201Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in AshHex · ash · fixed in 3.34.3
- CVE-2026-105677Ghost: Remote Code Execution via Theme Translation Filesnpm · ghost · fixed in 6.64.0
- CVE-2026-105676Ghost: Path Traversal via Locale Settingnpm · ghost · fixed in 6.64.0
- CVE-2026-105675Ghost: Invite Token Disclosure in Ghost Admin APInpm · ghost · fixed in 6.64.0
- CVE-2026-105652Ghost: Password Hash Ordering Disclosure in Ghost Admin APInpm · ghost · fixed in 6.64.0
- CVE-2026-105651Ghost: Stored XSS via Bookmark Card Imagesnpm · ghost · fixed in 6.64.0
- CVE-2026-105650Ghost: Stored XSS via oEmbed Photo Responsesnpm · ghost · fixed in 6.64.0
- CVE-2026-105649Ghost: Stored XSS via SVG Uploads Bypassing Sanitizationnpm · ghost · fixed in 6.65.0
- CVE-2026-105648Ghost: Private IP Filtering Bypass via IPv6 Transition Addressesnpm · ghost · fixed in 6.65.0
- CVE-2026-105647Ghost: Server-Side Request Forgery in Bookmark Fetchingnpm · ghost · fixed in 6.65.0
- CVE-2026-105646Ghost: Regular Expression Denial of Service in Content Importnpm · ghost · fixed in 6.67.0
- CVE-2026-105645Ghost: Regular Expression Denial of Service in External Media Inlinernpm · ghost · fixed in 6.67.0
- CVE-2026-105644Ghost: Stored XSS via SVG Files in Content Importsnpm · ghost · fixed in 6.67.0
- CVE-2026-105643Ghost: Stored XSS via Embed Card Previewsnpm · ghost · fixed in 6.67.0
- CVE-2026-105642Ghost: Remote Code Execution via Bookmark Card Imagesnpm · ghost · fixed in 6.67.0
- CVE-2026-102282adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalationnpm · adm-zip · fixed in 0.6.1
- CVE-2026-104891mppx-condition-gate: Free-access path grants on a self-declared wallet without proving controlnpm · @insumermodel/mppx-condition-gate, @insumermodel/mppx-token-gate · fixed in 3.0.0, 1.0.4
- CVE-2026-104890Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code executionPackagist · kunstmaan/bundles-cms, kunstmaan/media-bundle · fixed in 7.3.2
- CVE-2026-105315django-haystack more_like_this Template Tag elasticsearch_backend.py _to_python eval injectionPyPI · django-haystack · fixed in 3.4.0
- RUSTSEC-2026-0444`astral-tl` is unmaintainedcrates.io · astral-tl
- CVE-2026-105163crossplane crossplane-runtime ImageConfig client.go Get toctouGo · github.com/crossplane/crossplane-runtime/v2 · fixed in 2.4.0-rc.1, 2.3.3
- CVE-2026-104874Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtractionPyPI · multidict · fixed in 6.9.1
- CVE-2026-104873LangGraph SDK custom auth silently ignores actions= on resource decoratorsPyPI · langgraph-sdk · fixed in 0.4.4
- CVE-2026-103918@orpc/zod: Prototype injection in smart coercionnpm · @orpc/zod · fixed in 1.14.10
- CVE-2026-104872Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attributenpm · @opentelemetry/instrumentation-cassandra-driver, @opentelemetry/instrumentation-knex +6 · fixed in 0.66.0, 0.65.0, 0.67.0 and more
- CVE-2026-104871Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windowsnpm · @angular/ssr · fixed in 22.1.7, 21.2.23, 20.3.36
- CVE-2026-104861probe-image-size: Quadratic-time Denial of Service in the SVG Parsernpm · probe-image-size · fixed in 7.4.0