Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-87013Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cyclePyPI · open-webui · fixed in 0.11.1
- CVE-2026-87012Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert valuePyPI · open-webui · fixed in 0.11.1
- CVE-2026-87011Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logoutPyPI · open-webui · fixed in 0.11.1
- CVE-2026-53956Rattler vulnerable to package cache path traversal via conda package build stringPyPI · py-rattler · fixed in 0.24.0
- CVE-2026-47156MantisBT: SOAP API Authentication Bypass with Privilege Escalation to AdministratorPackagist · mantisbt/mantisbt · fixed in 2.28.4
- CVE-2026-86204PocketMine-MP before 5.39.2 Denial of Service via ModalFormResponsePacketPackagist · pocketmine/pocketmine-mp · fixed in 5.39.2
- CVE-2026-86203PocketMine-MP before 5.39.2 Item Duplication via Despawn StatePackagist · pocketmine/pocketmine-mp · fixed in 5.39.2
- CVE-2026-86202PocketMine-MP before 5.39.2 Network Amplification via ActorEventPacketPackagist · pocketmine/pocketmine-mp · fixed in 5.39.2
- CVE-2026-86201PocketMine-MP before 5.41.1 LogDoS via LoginPacket clientDataPackagist · pocketmine/pocketmine-mp · fixed in 5.41.1
- CVE-2026-86200PocketMine-MP before 5.42.1 LogDoS via LoginPacket clientData JWTPackagist · pocketmine/pocketmine-mp · fixed in 5.42.1
- CVE-2026-86198PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacketPackagist · pocketmine/pocketmine-mp · fixed in 5.44.2
- CVE-2025-71418PocketMine-MP before 5.25.2 Denial of Service via explodePackagist · pocketmine/pocketmine-mp · fixed in 5.25.2
- CVE-2025-71417PocketMine-MP before 5.32.1 Denial of Service via ResourcePackClientResponsePacketPackagist · pocketmine/pocketmine-mp · fixed in 5.32.1
- CVE-2024-58382league/commonmark before 2.6.0 Denial of Service via Quadratic ComplexityPackagist · league/commonmark · fixed in 2.6.0
- CVE-2024-58381PocketMine-MP before 5.11.1 Denial of Service via LoginPacketPackagist · pocketmine/pocketmine-mp · fixed in 5.11.1
- CVE-2024-58380PocketMine-MP before 5.11.2 Denial of Service via BookEditPacketPackagist · pocketmine/pocketmine-mp · fixed in 5.11.2
- CVE-2023-54396PocketMine-MP before 4.8.1 Server Crash via Banner NBTPackagist · pocketmine/pocketmine-mp · fixed in 4.8.1
- CVE-2023-54395PocketMine-MP before 4.12.5 Denial of Service via ModalFormResponsePacketPackagist · pocketmine/pocketmine-mp · fixed in 4.12.5
- CVE-2023-54394PocketMine-MP before 4.18.0-ALPHA2 Bandwidth Amplification via InventoryTransactionPacketPackagist · pocketmine/pocketmine-mp · fixed in 4.18.0-ALPHA2
- CVE-2023-54393PocketMine-MP before 4.20.5 Denial of Service via LoginPacketPackagist · pocketmine/pocketmine-mp · fixed in 4.20.5, 4.21.1
- CVE-2023-54392PocketMine-MP before 4.22.3 Denial of Service via BlockActorDataPacketPackagist · pocketmine/pocketmine-mp · fixed in 4.22.3, 5.2.1
- CVE-2023-54390PocketMine-MP before 5.3.1 Denial of Service via LoginPacketPackagist · pocketmine/pocketmine-mp · fixed in 5.3.1, 4.23.1
- CVE-2023-54355PocketMine-MP 5.2.0 Server Crash via Incorrect EC CurvePackagist · pocketmine/pocketmine-mp · fixed in 5.3.1
- CVE-2026-87819GitPython before 3.1.60 Denial of Service via ReDoSPyPI · gitpython · fixed in 3.1.60
- CVE-2026-87818GitPython 3.1.59 Local File Content Oracle via --no-indexPyPI · gitpython · fixed in 3.1.60
- CVE-2026-87817GitPython before 3.1.60 Remote Code Execution via Git Directory ImpersonationPyPI · gitpython · fixed in 3.1.60
- CVE-2026-47680Source controller: Improper path handling allows traversalGo · github.com/fluxcd/source-controller · fixed in 1.8.5
- CVE-2026-53637Sylius: Cart FormComponent allows modification or deletion of an already-completed orderPackagist · sylius/sylius · fixed in 2.0.18, 2.1.15, 2.2.6
- CVE-2026-53638Sylius: Channel-based payment method restriction bypass on shop account orders API endpointPackagist · sylius/sylius · fixed in 2.0.18, 2.1.15, 2.2.6
- CVE-2026-53639Sylius: IDOR on Shop Payment Request API endpointsPackagist · sylius/sylius · fixed in 2.0.18, 2.1.15, 2.2.6