Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-101084obot before v0.21.1 Authorization Bypass via /mcp-connectGo · github.com/obot-platform/obot · fixed in 0.21.1
- CVE-2026-101064Obot before v0.23.0 Server-Side Request Forgery via MCPGo · github.com/obot-platform/obot · fixed in 0.23.0
- CVE-2026-101063Obot before v0.23.0 Authentication Bypass via Registry APIGo · github.com/obot-platform/obot · fixed in 0.23.0
- CVE-2026-101062Obot before v0.23.0 Authentication Bypass via OAuth Dynamic Client RegistrationGo · github.com/obot-platform/obot · fixed in 0.23.0
- CVE-2026-101056Cloudreve before 4.16.1 Authentication Bypass via Cached Context HintGo · github.com/cloudreve/cloudreve, github.com/cloudreve/cloudreve/v3 +1
- CVE-2026-101051Cloudreve before 4.16.1 Path Traversal via Remote DownloadGo · github.com/cloudreve/cloudreve, github.com/cloudreve/cloudreve/v3 +1
- CVE-2026-101048Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scopeGo · github.com/cloudreve/cloudreve, github.com/cloudreve/cloudreve/v3 +1 · fixed in 4.0.0-20260626022735-332a9d800205
- CVE-2026-101047Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLsGo · github.com/fleetdm/fleet/v4 · fixed in 4.87.0
- CVE-2026-101046Fleet before 4.89.0 SQL Injection via ORDER BY Activity EndpointsGo · github.com/fleetdm/fleet/v4 · fixed in 4.89.0
- CVE-2026-101043pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settingsnpm · pnpm · fixed in 11.11.0, 10.34.5
- CVE-2026-100837Edgeless Systems Contrast through 1.20.0 Credential Leak via Registry Suffix MatchingGo · github.com/edgelesssys/contrast · fixed in 1.21.0
- CVE-2026-100836Edgeless Systems Contrast through 1.20.0 Denial of Service via ciphertextContainerGo · github.com/edgelesssys/contrast · fixed in 1.21.0
- CVE-2026-100857AzuraCast before 0.23.4 Remote Code Execution via Liquidsoap string interpolationPackagist · azuracast/azuracast · fixed in 0.23.4
- CVE-2026-100856AzuraCast before 0.23.6 Code Injection via Remote Relay PasswordPackagist · azuracast/azuracast · fixed in 0.23.6
- CVE-2026-100855AzuraCast before 0.23.6 Missing Permission Check via /playPackagist · azuracast/azuracast · fixed in 0.23.6
- CVE-2026-100854AzuraCast before 0.23.6 Metadata Injection via Liquidsoap APIPackagist · azuracast/azuracast · fixed in 0.23.6
- CVE-2026-100846MONAI before 1.5.2 Remote Code Execution via Pickle DeserializationPyPI · monai · fixed in 1.6.0, 1.5.2
- CVE-2026-100845MONAI before 1.6.0 Remote Code Execution via NumpyReaderPyPI · monai · fixed in 1.6.0
- CVE-2026-100844MONAI before 1.6.0 OS Command Injection via dataset_name_or_idPyPI · monai · fixed in 1.6.0
- CVE-2026-100843MONAI before 1.6.0 Remote Code Execution via algo_from_picklePyPI · monai · fixed in 1.6.0
- CVE-2026-100842MONAI through 1.6.0 _get_fake_spatial_shape eval() Sandbox Bypass via Attribute ChainsPyPI · monai · fixed in 1.6.1rc0
- CVE-2026-100841MONAI through 1.6.0 PersistentDataset Remote Code Execution via Pickle CachePyPI · monai
- CVE-2026-100840MONAI through 1.6.0 Remote Code Execution via bundle configurationPyPI · monai · fixed in 1.6.1rc0
- CVE-2026-100839Contrast before 1.18.0 AML Injection Remote Code ExecutionGo · github.com/edgelesssys/contrast · fixed in 1.18.0
- CVE-2026-100838Contrast before 1.19.1 CopyFile Policy Symlink SubversionGo · github.com/edgelesssys/contrast · fixed in 1.19.1
- CVE-2026-100834http4k before 6.48.0.0 Digest Authentication Replay Protection BypassMaven · org.http4k:http4k-security-digest · fixed in 6.48.0.0, 5.42.0.0, 4.51.0.0
- CVE-2026-100725http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorageMaven · org.http4k:http4k-core · fixed in 6.48.0.0, 5.42.0.0, 4.51.0.0
- CVE-2026-100724http4k before 6.49.0.0 Host Header Routing Bypass via reverseProxyMaven · org.http4k:http4k-core · fixed in 6.49.0.0, 5.42.0.0, 4.51.0.0
- CVE-2026-100723vm2 before 3.12.2 Memory Disclosure via zlib Buffer Poolnpm · vm2 · fixed in 3.12.2
- CVE-2026-100722vm2 before 3.12.2 Host Process Termination via Construct Trapnpm · vm2 · fixed in 3.12.2