Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-95842Moquette uncaught MQTT command exceptions can terminate shared session event loopsMaven · io.moquette:moquette-broker · fixed in 0.18.1
- CVE-2026-85724Moquette pattern ACL wildcard injection allows cross-tenant authorization bypassMaven · io.moquette:moquette-broker · fixed in 0.18.1
- CVE-2026-92164Streamlink: HTTPSession follows HTTP redirects into file:// URLs, reading local filesPyPI · streamlink · fixed in 8.6.0
- CVE-2026-73858Solspace Freeform: Limited Twig template injection via submitted field valuesPackagist · solspace/craft-freeform · fixed in 5.10.14
- CVE-2026-88974WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePostPackagist · wp-graphql/wp-graphql
- CVE-2026-63000REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon UpdatesPackagist · redaxo/source · fixed in 5.21.2
- CVE-2026-62998REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column EnumerationPackagist · redaxo/source · fixed in 5.21.2
- CVE-2026-63002REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem FilenamesPackagist · redaxo/source · fixed in 5.21.2
- CVE-2026-63001REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`Packagist · redaxo/source · fixed in 5.21.2
- CVE-2026-61834scim-patch: Mutation of Inherited Built-in Method Objectsnpm · scim-patch · fixed in 0.9.2
- CVE-2026-59167SunEditor: Critical XSS vulnerability - sanitizer bypassnpm · suneditor · fixed in 2.47.11
- RUSTSEC-2026-0394Build environment compiled into the library and readable at runtimecrates.io · rustpython-vm · fixed in 0.6.0
- CVE-2026-91777jackson-databind: quadratic forward-reference completion in Collection and Map deserializersMaven · com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind · fixed in 2.21.7, 2.18.11, 2.22.3 and more
- CVE-2026-91776jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type IDMaven · com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind · fixed in 2.18.11, 2.21.7, 2.22.3 and more
- CVE-2026-89425jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growthMaven · com.fasterxml.jackson.core:jackson-core, tools.jackson.core:jackson-core · fixed in 2.21.7, 2.22.3, 2.18.11 and more
- CVE-2026-61685ReactPress has SQL injection via dynamic column names in TypeORM query buildersnpm · @fecommunity/reactpress · fixed in 3.7.0
- CVE-2026-57576plone.app.dexterity and plone.app.contenttypes have a Denial of Service due to excessive title or description lengthPyPI · plone-app-dexterity · fixed in 5.0.1, 4.1.3, 3.2.3
- CVE-2026-77426Unleash: Missing await on permission check + cross-project IDOR in admin APInpm · unleash-server · fixed in 8.0.3
- CVE-2026-77425Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit lognpm · unleash-server · fixed in 8.0.3
- CVE-2026-76910Unleash: Clone-feature lets a user copy a feature from a project they cannot readnpm · unleash-server · fixed in 8.0.3
- CVE-2026-76909Unleash: CR-approval email renders user-controlled raw HTMLnpm · unleash-server · fixed in 8.0.3
- CVE-2026-62364wlc may disclose API tokens to project-configured URLsPyPI · wlc · fixed in 2.0.1
- CVE-2026-79767Gardener: Authorization Bypass via Group Subject InjectionGo · gardener/gardener, github.com/gardener/gardener · fixed in 1.143.3, 1.144.2, 1.142.6
- CVE-2026-61570MPXJ: XXE Vulnerability in MerlinReaderPyPI · mpxj · fixed in 16.4.1
- CVE-2026-65829MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readersPyPI · mpxj · fixed in 16.5.0
- CVE-2026-77322SIPGO: DoS via unvalidated WebSocket frame lengthGo · github.com/emiago/sipgo · fixed in 1.4.3
- CVE-2026-58268SIPGO: DoS via unvalidated Content-Length in the stream parserGo · github.com/emiago/sipgo · fixed in 1.4.1
- CVE-2026-83805Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobsPyPI · nautobot · fixed in 3.1.8
- CVE-2026-83801Nautobot: Stored cross-site scripting (XSS) in object create/edit form help textPyPI · nautobot · fixed in 2.4.37, 3.1.8
- CVE-2026-62985request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js processnpm · request-filtering-agent · fixed in 3.2.1