Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-96748Connection redirection via percent-encoded delimiter injection in connection string hostsPyPI · pymongo · fixed in 4.18.2
- CVE-2026-96747Forced local Unix socket connection via dot-sock KMS endpoint in client-side field encryptionPyPI · pymongo · fixed in 4.18.2
- CVE-2026-62286Dozzle label filters do not restrict container event and statistics streamsGo · github.com/amir20/dozzle · fixed in 1.29.1-0.20260622172006-19c01e0fb491
- CVE-2026-61816zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIMEPackagist · zbateson/mail-mime-parser · fixed in 3.0.6, 4.0.2
- CVE-2026-61815zbateson/mail-mime-parser has CRLF header injection via attachment filenamePackagist · zbateson/mail-mime-parser · fixed in 3.0.6, 4.0.2
- CVE-2026-61741http4s-scala-xml has an XML External Entity (XXE) processing issueMaven · org.http4s:http4s-scala-xml_2.12, org.http4s:http4s-scala-xml_2.13 +1 · fixed in 0.24.1, 1.0.0-M39
- CVE-2026-61604ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypassGo · github.com/ixofoundation/ixo-blockchain, github.com/ixofoundation/ixo-blockchain/v3 +5 · fixed in 8.0.0
- CVE-2026-61732Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM contextPyPI · decepticon, decepticon-core +1 · fixed in 1.1.17
- CVE-2026-61788@bytebase/dbhub's read-only mode does not prevent database writesnpm · @bytebase/dbhub · fixed in 0.22.6
- CVE-2026-61784xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSSnpm · xhtml-purifier · fixed in 0.4.3
- CVE-2026-85056ZITADEL: MFA bypass via session reuse in Login V2Go · github.com/zitadel/zitadel · fixed in 1.80.0-v2.20.0.20260717062356-56f4798ed31f
- CVE-2026-61782@rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadatanpm · @rsdoctor/rspack-plugin · fixed in 1.5.16
- CVE-2026-85057ZITADEL: Actions V1 sandbox escape: host file read via require()Go · github.com/zitadel/zitadel · fixed in 1.80.0-v2.20.0.20260717062331-baf6ed501b68
- CVE-2026-61742DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL executionnpm · @bytebase/dbhub · fixed in 0.22.5
- CVE-2026-57179social-auth-core has a Session Fixation issuePyPI · social-auth-core · fixed in 5.0.0
- CVE-2026-57178social-auth-core: VK App backend accepts unsigned callback data when auth_key is missingPyPI · social-auth-core · fixed in 5.0.0
- CVE-2026-57177social-auth-core has Login CSRF via Missing State Parameter in LoginRadius BackendPyPI · social-auth-core · fixed in 5.0.0
- CVE-2026-57176social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend BackendPyPI · social-auth-core · fixed in 5.0.0
- CVE-2026-57175social-auth-core has an Improper Authentication issuePyPI · social-auth-core · fixed in 5.0.0
- CVE-2026-56744`@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction (can redirect payments when using remote storage)npm · @bsv/wallet-toolbox, @bsv/wallet-toolbox-client +1 · fixed in 2.4.0
- CVE-2026-62368Snipe-IT: Stored XSS via Custom Field name in asset-list column headersPackagist · snipe/snipe-it · fixed in 8.7.0
- CVE-2026-63493Snipe-IT: 2FA bypass via the API token flowPackagist · snipe/snipe-it · fixed in 8.7.0
- CVE-2026-47132phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User EnumerationPackagist · thorsten/phpmyfaq · fixed in 4.2.0-alpha
- CVE-2026-56738phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word InsertionPackagist · phpmyfaq/phpmyfaq, thorsten/phpmyfaq · fixed in 4.1.6
- CVE-2026-63498Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files APIPackagist · snipe/snipe-it · fixed in 8.7.0
- CVE-2026-56737phpMyFAQ's two-factor authentication login bypasses the password factorPackagist · phpmyfaq/phpmyfaq, thorsten/phpmyfaq · fixed in 4.1.6
- CVE-2026-56736phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ SubmissionPackagist · phpmyfaq/phpmyfaq, thorsten/phpmyfaq · fixed in 4.2.0-alpha
- CVE-2026-91187Improper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategyHex · nimble_zta · fixed in 0.1.3
- CVE-2026-59980hpack: Unbounded variable integer decoding can cause run-away computation on malformed inputPyPI · hpack · fixed in 4.2.0
- CVE-2026-96889Librsvg: use-after-free when xml includes have duplicated entitiescrates.io · librsvg · fixed in 2.57.5, 2.60.3, 2.61.5 and more