Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-93989vLLM through 0.29.0 Cross-Request Logits Corruption via bad_wordsPyPI · vllm · fixed in 0.30.0
- CVE-2026-93981hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Stringsnpm · hono · fixed in 4.13.7
- CVE-2026-61670microsandbox: Secret values exposed in world-readable process argumentscrates.io · microsandbox · fixed in 0.5.10
- CVE-2026-92708devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffersnpm · devalue · fixed in 5.9.3
- CVE-2026-77528Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflationPyPI · autobahn, crossbar · fixed in 26.7.1
- CVE-2026-93841vLLM through 0.29.0 Adjacent-Request Sampler State Corruption via Unvalidated Prompt Token IDsPyPI · vllm · fixed in 0.30.0
- CVE-2026-93840vLLM before 0.29.0 Cross-Request Logits Corruption via allowed_token_idsPyPI · vllm · fixed in 0.29.0
- CVE-2026-59163Mnemosyne has JWT signature verification bypass sync server that allows authentication bypassPyPI · mnemosyne-memory · fixed in 3.10.1
- CVE-2026-93749source-map-js through 1.2.1 Event Loop Denial of Servicenpm · source-map-js · fixed in 1.2.2
- CVE-2026-93748http-cache-semantics through 4.2.0 Cross-User Cache Disclosure via max-stalenpm · http-cache-semantics
- CVE-2026-71537Paymenter: Credit-refund double-spend race condition in service downgrade (doUpgrade)Packagist · paymenter/paymenter · fixed in 1.5.7
- CVE-2026-85058Moquette: Missing Authorization in io.moquette:moquette-brokerMaven · io.moquette:moquette-broker · fixed in 0.18.1
- CVE-2026-63445Perses: Unvalidated project parameter enables filesystem path traversalGo · github.com/perses/perses · fixed in 0.54.0-rc.0
- CVE-2026-63199Perses: Missing authorization in datasource proxy allows cross-scope secret disclosureGo · github.com/perses/perses · fixed in 0.54.0-rc.0
- CVE-2026-63458Perses project query parameter authorization bypass exposes cross-project resourcesGo · github.com/perses/perses · fixed in 0.54.0-beta.3
- CVE-2026-91127File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderernpm · @file-viewer/doc, msdoc-viewer · fixed in 2.3.1, 0.2.2
- CVE-2026-33625LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loadingPyPI · lmdeploy · fixed in 0.12.3
- CVE-2026-84992md-editor-v3: XSS via fenced-code language rendering bypassnpm · md-editor-v3 · fixed in 6.5.4
- CVE-2026-64847AnyIO process-pool workers can block indefinitely on undrained stderrPyPI · anyio · fixed in 4.14.2
- CVE-2025-66455LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.pyPyPI · lmdeploy · fixed in 0.16.0
- CVE-2026-63349AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groupsPyPI · anyio · fixed in 4.14.2
- CVE-2026-77616Semantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination tokenPackagist · mediawiki/semantic-media-wiki · fixed in 7.2.0
- CVE-2026-61833zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletionGo · zotregistry.dev/zot, zotregistry.dev/zot/v2 · fixed in 2.1.18
- CVE-2026-77610Semantic MediaWiki has a query debug output XSS (`DebugFormatter`)Packagist · mediawiki/semantic-media-wiki · fixed in 7.2.0
- CVE-2026-77609Semantic MediaWiki has an open redirect in Special:URIResolverPackagist · mediawiki/semantic-media-wiki · fixed in 7.2.0
- CVE-2026-63406AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including SecretsGo · github.com/anycable/anycable, github.com/anycable/anycable-go · fixed in 1.6.15
- CVE-2026-77607Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSSPackagist · mediawiki/semantic-media-wiki · fixed in 7.2.0
- CVE-2026-63405AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary BodyGo · github.com/anycable/anycable, github.com/anycable/anycable-go · fixed in 1.6.15
- CVE-2026-77608Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)Packagist · mediawiki/semantic-media-wiki · fixed in 7.2.0
- CVE-2026-77606Semantic MediaWiki has reflected XSS in Special:Ask plain table headersPackagist · mediawiki/semantic-media-wiki · fixed in 7.2.0