Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-55864GeoNetwork: Unauthenticaded Server-Side Request Forgery in SLD ToolMaven · org.geonetwork-opensource:gn-web-app · fixed in 4.4.12, 4.2.17
- CVE-2026-55630Kiwi TCMS: Stored XSS via javascript: URI in extra_link field (TestPlan & TestCase)PyPI · kiwitcms
- CVE-2026-54724Kiwi TCMS: Open Redirect via unvalidated next parameter in account confirmation endpointPyPI · kiwitcms
- CVE-2026-55211surfio IRAP header size fields cause out-of-bounds readsPyPI · surfio · fixed in 0.0.19
- CVE-2026-55636Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotectedGo · github.com/projectcapsule/capsule · fixed in 0.13.6
- CVE-2026-44282Election question titles allow stored script executionRubyGems · decidim-elections · fixed in 0.32.0
- CVE-2026-91992Tornado before 6.5.7 Credential Leak via Handle ReusePyPI · tornado · fixed in 6.5.7
- CVE-2026-91991Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargsPyPI · tornado · fixed in 6.5.8
- CVE-2026-65831ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file readMaven · com.arcadedb:arcadedb-server · fixed in 26.7.1
- CVE-2026-91990Tornado before 6.5.8 Memory Amplification DoS via multipartPyPI · tornado · fixed in 6.5.8
- CVE-2026-91989atomic-agents-stack before 1.1.0 Path Traversal via dashboard serve.pyPyPI · atomic-agents-stack · fixed in 1.1.0
- CVE-2026-91988atomic-agents-stack before 1.1.0 Remote Code Execution via HTTP MCPPyPI · atomic-agents-stack · fixed in 1.1.0
- CVE-2026-91987atomic-agents-stack before 1.1.0 Cost Guardrail Bypass via Unknown ModelPyPI · atomic-agents-stack · fixed in 1.1.0
- CVE-2026-91985Vikunja before 2.6.0 Privilege Escalation via Link Share HashGo · code.vikunja.io/api · fixed in 2.6.0
- CVE-2026-91984Vikunja before 2.6.0 Broken Object-Level Authorization via task-positionGo · code.vikunja.io/api · fixed in 2.6.0
- CVE-2026-91983Vikunja before 2.6.0 API Token Scope Bypass via expand ParameterGo · code.vikunja.io/api · fixed in 2.6.0
- CVE-2026-91982Vikunja before 2.6.0 TOTP Secret Disclosure via APIGo · code.vikunja.io/api · fixed in 2.6.0
- CVE-2026-91981Vikunja before 2.6.0 User Enumeration via v2 APIGo · code.vikunja.io/api · fixed in 2.6.0
- CVE-2026-91980vikunja before 2.6.0 Team Enumeration via Project ShareGo · code.vikunja.io/api · fixed in 2.6.0
- CVE-2026-91979Vikunja before 2.6.0 Denial of Service via Decompression BombGo · code.vikunja.io/api · fixed in 2.6.0
- CVE-2026-91973Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuthGo · code.vikunja.io/api · fixed in 2.6.0
- CVE-2026-91972Vikunja before 2.6.0 Authentication Bypass via Unthrottled APIGo · code.vikunja.io/api · fixed in 2.6.0
- CVE-2026-91971Vikunja before 2.6.0 Denial of Service via Avatar UploadGo · code.vikunja.io/api · fixed in 2.6.0
- CVE-2026-91970Vikunja before 2.6.0 Resource Exhaustion via Planka MigrationGo · code.vikunja.io/api · fixed in 2.6.0
- CVE-2026-91969vikunja before 2.6.0 Resource Exhaustion via CSV MigrationGo · code.vikunja.io/api · fixed in 2.6.0
- CVE-2026-91968vikunja before 2.6.0 Denial of Service via unbounded filter recursionGo · code.vikunja.io/api · fixed in 2.6.0
- CVE-2024-58384Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClientPyPI · tornado · fixed in 6.4.1
- CVE-2024-14029Tornado before 6.4.1 HTTP Request Smuggling via Transfer-EncodingPyPI · tornado · fixed in 6.4.1
- CVE-2023-54397Tornado before 6.3.3 HTTP Request Smuggling via Content-LengthPyPI · tornado · fixed in 6.3.3
- CVE-2026-54077ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated usersMaven · com.arcadedb:arcadedb-engine · fixed in 26.6.1