Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-82405Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated callerGo · github.com/klever-io/klever-go · fixed in 1.7.20
- CVE-2026-82409Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgeryGo · github.com/klever-io/klever-go · fixed in 1.7.20
- CVE-2026-82407Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoSGo · github.com/klever-io/klever-go · fixed in 1.7.20
- CVE-2026-86065Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)Go · github.com/klever-io/klever-go · fixed in 1.7.20
- CVE-2026-86064Klever-Go: /log controls global node loggingGo · github.com/klever-io/klever-go · fixed in 1.7.20
- CVE-2026-82406Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplaceGo · github.com/klever-io/klever-go · fixed in 1.7.20
- CVE-2026-93421Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting EndpointPyPI · mesop · fixed in 1.3.4
- CVE-2026-77602OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)RubyGems · openc3 · fixed in 7.3.0
- CVE-2026-77394OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widgetnpm · @openc3/vue-common · fixed in 7.3.0
- CVE-2026-77601OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` settingRubyGems · openc3 · fixed in 7.3.0
- CVE-2026-59990Jawn: Uncontrolled nesting depth in JSON parserMaven · org.typelevel:jawn-parser_2.12, org.typelevel:jawn-parser_2.13 +1 · fixed in 1.7.0
- CVE-2026-61814Jawn: Quadratic parsing effort in AsyncParserMaven · org.typelevel:jawn-parser_2.12, org.typelevel:jawn-parser_2.13 +1 · fixed in 1.7.0
- CVE-2026-76087Formie: Unauthenticated users can overwrite incomplete submissions via submit actionPackagist · verbb/formie · fixed in 3.1.31, 2.2.23
- CVE-2026-76086Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentialsPackagist · verbb/formie · fixed in 3.1.31, 2.2.23
- CVE-2026-76089Formie: Missing authorization on sent notification resend modal exposes submission PIIPackagist · verbb/formie · fixed in 3.1.31, 2.2.23
- CVE-2026-92692Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)Packagist · sulu/sulu · fixed in 2.6.25, 3.0.8
- CVE-2026-77420JLine: ReDoS via `HISTORY_IGNORE` Configuration VariableMaven · org.jline:jline-reader · fixed in 4.3.1, 3.30.15
- CVE-2026-77422JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` WrappingMaven · org.jline:jline-builtins · fixed in 4.3.1, 3.30.15
- CVE-2026-77421JLine: ReDoS in Nano Editor Regex Search ModeMaven · org.jline:jline-builtins · fixed in 4.3.1, 3.30.15
- CVE-2026-63132OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing AttackGo · github.com/openbao/openbao · fixed in 0.0.0-20260713141742-763625a20721
- CVE-2026-63131OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix)Go · github.com/openbao/openbao · fixed in 0.0.0-20260713133043-f58d848c139e
- CVE-2026-77285OpenBao Agent Writes Secrets to StdoutGo · github.com/openbao/openbao · fixed in 0.0.0-20260714163218-90272575e5f5
- CVE-2026-92700Caddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files via case variationGo · github.com/caddyserver/caddy/v2 · fixed in 2.11.4
- CVE-2026-92284Caddy: Unbounded body buffer via {http.request.body} placeholder — memory exhaustion DoSGo · github.com/caddyserver/caddy/v2 · fixed in 2.11.4
- CVE-2026-95848Moquette fails open when configured authentication or authorization classes cannot loadMaven · io.moquette:moquette-broker · fixed in 0.18.1
- CVE-2026-95847Moquette client IDs can cause cross-session H2 durable-queue corruptionMaven · io.moquette:moquette-broker · fixed in 0.18.1
- CVE-2026-95846Moquette publishes Last-Will messages without enforcing write authorizationMaven · io.moquette:moquette-broker · fixed in 0.18.1
- CVE-2026-95845Moquette unbounded per-session message queues allow memory exhaustionMaven · io.moquette:moquette-broker · fixed in 0.18.1
- CVE-2026-95844Moquette deeply nested MQTT topics can cause stack exhaustionMaven · io.moquette:moquette-broker · fixed in 0.18.1
- CVE-2026-95843Moquette malformed shared subscriptions can crash command processingMaven · io.moquette:moquette-broker · fixed in 0.18.1