Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-57130PraisonAI: IMAP Command Injection via Unsanitized Email Search ParametersPyPI · praisonaiagents · fixed in 1.6.59
- CVE-2026-57128PraisonAI: Unauthenticated Event Injection via SSE `/publish` EndpointPyPI · praisonaiagents · fixed in 1.6.59
- CVE-2026-57115PraisonAI: SpiderTools redirect-target SSRF protection bypassPyPI · praisonaiagents · fixed in 1.6.59
- CVE-2026-57125PraisonAI: Unauthenticated RCE via Jobs API + Approval BypassPyPI · praisonai, praisonaiagents · fixed in 4.6.59, 1.6.59
- CVE-2026-90936Froxlor before 2.3.7 Information Disclosure via customer_email.phpPackagist · froxlor/froxlor · fixed in 2.3.7
- CVE-2026-90935Froxlor before 2.3.7 Authorization Bypass via Mysqls.add APIPackagist · froxlor/froxlor · fixed in 2.3.7
- CVE-2024-58383Froxlor before 2.2.0 Insecure File Permissions mysql.confPackagist · froxlor/froxlor · fixed in 2.2.0
- CVE-2026-88932multer vulnerable to Denial of Service via orphaned disk writes on aborted uploadsnpm · multer · fixed in 2.4.0
- CVE-2023-45023The femanager extension 7 before 7.2.2 for TYPO3 has Incorrect Access Control: it lacks a check for permissions for the invitation componentPackagist · in2code/femanager · fixed in 7.2.2
- CVE-2023-46035The svg_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents.RubyGems · svg_optimizer · fixed in 0.3.0
- CVE-2023-50459An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3.Packagist · in2code/femanager · fixed in 7.2.3
- CVE-2023-50461An issue was discovered in the direct_mail (aka Direct Mail) extension through 9.5.1 for TYPO3.Packagist · directmailteam/direct-mail · fixed in 9.5.2, 7.0.3, 6.0.3
- CVE-2023-50462An issue was discovered in the content_consent (aka Content Consent) extension through 2.0.1 for TYPO3.Packagist · t3s/content-consent · fixed in 2.0.2, 1.0.3
- CVE-2026-90776Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsingnpm · nodemailer · fixed in 10.0.5
- CVE-2026-90771joi before 17.13.8 and 18.2.9 Prototype Pollution via messagesnpm · joi · fixed in 17.13.8, 18.2.9
- CVE-2026-90553vLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 processorPyPI · vllm · fixed in 0.28.0
- CVE-2026-49992Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure ChangesPackagist · kimai/kimai · fixed in 2.58.0
- CVE-2026-50018Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve ActionsGo · github.com/spectolabs/hoverfly · fixed in 1.12.8
- CVE-2026-50013Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff ModeGo · github.com/spectolabs/hoverfly · fixed in 1.12.8
- CVE-2026-48496opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agentGo · go.opentelemetry.io/ebpf-profiler · fixed in 0.0.202622
- CVE-2026-45056Matrix Rust SDK: Sender-binding gaps in to-device and room-key attributioncrates.io · matrix-sdk-crypto · fixed in 0.16.1
- CVE-2026-45057matrix-sdk-ui: Incomplete edit validationcrates.io · matrix-sdk-ui · fixed in 0.16.1
- CVE-2026-49865Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLsPackagist · kimai/kimai · fixed in 2.58.0
- CVE-2026-54174melange: Incomplete package integrity verification allows data section substitutionGo · chainguard.dev/apko, chainguard.dev/melange · fixed in 1.2.9, 0.50.4
- CVE-2026-49439OpenRemote read-only asset users can write predicted datapointsMaven · io.openremote:openremote-manager · fixed in 1.24.1
- CVE-2026-49464NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taakMaven · nl.nl-portal:taak · fixed in 3.0.1
- CVE-2026-49463NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-librariesMaven · nl.nl-portal:besluiten, nl.nl-portal:documenten-api · fixed in 3.0.1
- CVE-2026-54072Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URLGo · github.com/authorizerdev/authorizer · fixed in 0.0.0-20260409051328-bd3f5baf6d3d
- CVE-2026-89090Denial of service in the event stream header decoder in AWS SDK for Go v2Go · github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream, github.com/aws/aws-sdk-go-v2/service/bedrockagentcore +10 · fixed in 1.7.8, 1.15.2, 1.51.8 and more
- CVE-2026-68497jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of serviceMaven · com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind · fixed in 2.18.10, 2.21.6, 2.22.2 and more