Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-47680Source controller: Improper path handling allows traversalGo · github.com/fluxcd/source-controller · fixed in 1.8.5
- CVE-2026-53637Sylius: Cart FormComponent allows modification or deletion of an already-completed orderPackagist · sylius/sylius · fixed in 2.0.18, 2.1.15, 2.2.6
- CVE-2026-53638Sylius: Channel-based payment method restriction bypass on shop account orders API endpointPackagist · sylius/sylius · fixed in 2.0.18, 2.1.15, 2.2.6
- CVE-2026-53639Sylius: IDOR on Shop Payment Request API endpointsPackagist · sylius/sylius · fixed in 2.0.18, 2.1.15, 2.2.6
- CVE-2026-86075n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpointnpm · n8n · fixed in 2.38.2, 2.37.7
- CVE-2026-86076n8n: Expression Sandbox Escape in Editor-UI Enables Stored Cross-User JavaScript Executionnpm · n8n · fixed in 1.123.76, 2.38.2, 2.37.7
- CVE-2026-86077n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocketnpm · n8n · fixed in 2.38.2, 2.37.7
- CVE-2026-86078n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Servicenpm · n8n · fixed in 2.38.2, 2.37.7
- CVE-2026-86079n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiersnpm · n8n · fixed in 1.123.76, 2.38.2, 2.37.7
- CVE-2026-86080n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Opennpm · n8n · fixed in 1.123.76, 2.38.2, 2.37.7
- CVE-2026-86081n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Pathnpm · n8n · fixed in 1.123.76, 2.38.2, 2.37.7
- CVE-2026-86082n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Nodenpm · n8n · fixed in 1.123.76, 2.38.2, 2.37.7
- CVE-2026-86083n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Executionnpm · n8n · fixed in 1.123.76, 2.38.2, 2.37.7
- CVE-2026-86084n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessionsnpm · n8n · fixed in 1.123.76, 2.38.2, 2.37.7
- CVE-2026-86085n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpointsnpm · n8n · fixed in 2.38.2, 2.37.7
- CVE-2026-86993n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Checknpm · n8n · fixed in 1.123.76, 2.38.2, 2.37.7
- CVE-2026-86994n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filternpm · n8n · fixed in 1.123.76, 2.38.2, 2.37.7
- CVE-2026-86995n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Readnpm · n8n · fixed in 1.123.76, 2.38.2, 2.37.7
- CVE-2026-86996n8n: Agent Workflow Tool Bypasses Sub-Workflow Caller Policynpm · n8n · fixed in 2.38.2, 2.37.7
- CVE-2026-81192OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOSNuGet · opentelemetry.resources.host · fixed in 1.16.0-beta.2
- CVE-2026-86074n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Contentnpm · n8n · fixed in 2.38.2, 2.37.7
- CVE-2026-71328.NET and Visual Studio Remote Code Execution VulnerabilityNuGet · microsoft.diasymreader.native · fixed in 18.9.0-beta1.26405.2
- CVE-2026-69304ASP.NET Core Denial of Service VulnerabilityNuGet · microsoft.aspnetcore.server.iisintegration · fixed in 11.0.0-rc.1, 8.0.31, 9.0.20 and more
- CVE-2026-69439.NET and Visual Studio Elevation of Privilege VulnerabilityNuGet · microsoft.diasymreader.native · fixed in 18.9.0-beta1.26405.2
- CVE-2026-72923Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansionNuGet · microsoft.openapi.readers, microsoft.openapi.yamlreader · fixed in 1.6.30, 3.10.0, 2.12.0
- CVE-2026-69522.NET and Visual Studio Remote Code Execution VulnerabilityNuGet · microsoft.diasymreader.native · fixed in 18.9.0-beta1.26405.2
- CVE-2026-86073n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitutionnpm · n8n · fixed in 2.38.1, 2.37.7
- CVE-2026-82533DeepSeek Harness < 0.1.2-alpha.1 Authentication Bypass via Host Header Spoofingnpm · @deepseek-ai/dsh-client-connection · fixed in 0.1.2-alpha.1
- CVE-2026-86597Sensitive information written to logs by Snowflake driversnpm · snowflake-sdk · fixed in 3.3.0
- CVE-2026-76969Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)npm · @sap/cds-mtxs · fixed in 4.0.3, 3.9.7, 2.7.7 and more