Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-100722vm2 before 3.12.2 Host Process Termination via Construct Trapnpm · vm2 · fixed in 3.12.2
- CVE-2026-100721vm2 before 3.12.2 Authorization Bypass via Custom Resolvernpm · vm2 · fixed in 3.12.2
- CVE-2025-71426Contrast before 1.4.1 Coordinator Impersonation via Unauthenticated RecoveryGo · github.com/edgelesssys/contrast · fixed in 1.4.1
- CVE-2025-71425Contrast before 1.8.1 Information Disclosure via LoggingGo · github.com/edgelesssys/contrast · fixed in 1.8.1
- CVE-2025-71424Edgeless Systems Contrast before 1.9.1 Insecure Volume MountGo · github.com/edgelesssys/contrast · fixed in 1.9.1
- CVE-2025-71423Edgelesssys Contrast before 1.12.2 Workload Secrets Information DisclosureGo · github.com/edgelesssys/contrast · fixed in 1.12.2
- CVE-2025-71422Contrast before 1.12.1 Insecure LUKS2 Persistent StorageGo · github.com/edgelesssys/contrast · fixed in 1.12.1
- CVE-2026-100702Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arraysnpm · nodemailer · fixed in 10.0.2
- CVE-2026-100701Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusionnpm · nodemailer · fixed in 10.0.2
- CVE-2026-100700nodemailer before 10.0.6 Denial of Service via addressparsernpm · nodemailer · fixed in 10.0.6
- CVE-2026-100699Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Commentnpm · nodemailer · fixed in 10.0.9
- CVE-2026-100689GitPython before 3.1.62 Path Traversal via gitmodules pathPyPI · gitpython · fixed in 3.1.62
- CVE-2026-100653vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin PropagationPyPI · vllm · fixed in 0.28.0
- CVE-2026-100652vLLM 0.22.0 through 0.23.0 Denial of Service via stop_token_idsPyPI · vllm · fixed in 0.24.0
- CVE-2026-100650vLLM before 0.29.0 Resource Exhaustion via Unbounded Media MaterializationPyPI · vllm · fixed in 0.30.0
- CVE-2026-100582OpenClaw Channel Plugins before 2026.8.1 Channel Read Allowlist Bypassnpm · @openclaw/feishu, @openclaw/googlechat +2 · fixed in 2026.8.1
- CVE-2026-57449Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Tokennpm · @actual-app/sync-server · fixed in 26.7.0
- CVE-2026-57443SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email DigestsPyPI · scbe-aethermoore · fixed in 4.2.1
- CVE-2026-100369CliInvoke: Argument Injection in Extensibility Runner FactoryNuGet · alastairlundy.cliinvoke, cliinvoke · fixed in 2.0.2, 2.8.5, 2.9.4 and more
- CVE-2026-100368CliInvoke.Specializations: Command injection in PowerShell and Cmd shell wrappersNuGet · alastairlundy.cliinvoke.specializations, cliinvoke.specializations · fixed in 2.0.2, 2.8.5, 2.9.4 and more
- CVE-2026-93363Payload CMS storage-vercel-blob Adapter Improper Access Control on Upload Routenpm · @payloadcms/storage-vercel-blob · fixed in 3.90.0, 4.0.0-canary.34
- CVE-2026-92161FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth providerPackagist · fof/oauth · fixed in 1.7.4, 2.0.0-beta.4
- CVE-2026-97875DNS rebinding vulnerability in rojo serve HTTP APIcrates.io · rojo · fixed in 7.7.0
- CVE-2026-92106lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSSHex · lazy_html · fixed in 0.1.13
- CVE-2026-93477Private action arguments can be set by user input on the bulk destroy and bulk update paths in AshHex · ash · fixed in 3.33.11
- CVE-2026-53493Containerd has image-pull DoS via crafted OCI index graph amplificationGo · github.com/containerd/containerd, github.com/containerd/containerd/v2 · fixed in 1.7.36, 2.0.13, 2.2.9 and more
- CVE-2026-57440Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabledPackagist · starcitizenwiki/embedvideo · fixed in 4.1.0
- CVE-2026-61823code16 Sharp vulnerable to stored XSS via iframe srcdoc AttributePackagist · code16/sharp · fixed in 9.22.5
- CVE-2026-61825code16/sharp has a stored XSS via data-html-content Sanitizer BypassPackagist · code16/sharp · fixed in 9.22.5
- CVE-2026-96749Heap out-of-bounds write via signed size overflow in BSON document encodingPyPI · pymongo · fixed in 4.18.2