Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-86251h3 before 1.15.9 Path Traversal via Double Decodingnpm · h3 · fixed in 1.15.9
- CVE-2026-86250h3 before 2.0.1-rc.18 Denial of Service via Unbounded Chunked Cookienpm · h3 · fixed in 2.0.1-rc.18
- CVE-2026-86205h3 before 2.0.1-rc.18 Open Redirect via redirectBack()npm · h3 · fixed in 2.0.1-rc.18
- CVE-2022-51009PocketMine-MP before 4.7.2 Denial of Service via Skin GeometryPackagist · pocketmine/pocketmine-mp · fixed in 4.7.2
- CVE-2021-48007PocketMine-MP before 3.18.1 Denial of Service via MovePlayerPacketPackagist · pocketmine/pocketmine-mp · fixed in 3.18.1
- CVE-2021-48006PocketMine-MP before 4.0.3 Operator Privilege Escalation via Case SensitivityPackagist · pocketmine/pocketmine-mp · fixed in 4.0.3
- CVE-2020-37277PocketMine-MP before 3.15.4 Denial of Service via InventoryTransactionPackagist · pocketmine/pocketmine-mp · fixed in 3.15.4
- CVE-2026-86197Grav before 2.0.20 Cross-Site Scripting via Assets SandboxPackagist · getgrav/grav · fixed in 2.0.20
- CVE-2026-52777YesWiki: Authenticated PHP Object Injection in BazarImportAction via unserializePackagist · yeswiki/yeswiki · fixed in 4.6.6
- CVE-2026-52775YesWiki Authenticated SQL Injection in ReactionManagerPackagist · yeswiki/yeswiki · fixed in 4.6.6
- CVE-2026-52774Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes in YesWikiPackagist · yeswiki/yeswiki · fixed in 4.6.6
- CVE-2026-52773Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php` in YesWikiPackagist · yeswiki/yeswiki · fixed in 4.6.6
- CVE-2026-52772YesWiki: Bazar form-field templates still apply `|raw('html')` to `field.label` / `field.hint` in attribute and label-body contexts — stored XSS in form renders (sibling class of commit `e6b66aa`)Packagist · yeswiki/yeswiki · fixed in 4.6.6
- CVE-2026-52771YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)Packagist · yeswiki/yeswiki · fixed in 4.6.6
- CVE-2026-52770Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in yeswiki/yeswikiPackagist · yeswiki/yeswiki · fixed in 4.6.6
- CVE-2026-52769YesWiki: Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId`Packagist · yeswiki/yeswiki · fixed in 4.6.6
- CVE-2026-52767YesWiki: Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)`Packagist · yeswiki/yeswiki · fixed in 4.6.6
- CVE-2026-52766YesWiki: Unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` actionPackagist · yeswiki/yeswiki · fixed in 4.6.6
- CVE-2026-52763YesWiki: SQL injection via the `recentchanges` action `period` argument leading to arbitrary DB readPackagist · yeswiki/yeswiki · fixed in 4.6.6
- CVE-2026-52762YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic TemplatesPackagist · yeswiki/yeswiki · fixed in 4.6.6
- CVE-2026-48019CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relayPackagist · laravel/framework · fixed in 13.10.0, 12.60.0
- CVE-2026-53769Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policyRubyGems · avo · fixed in 3.32.0
- CVE-2026-53932wnx/laravel-backup-restore: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') and Improper Neutralization of Special Elements used in a Command ('Command Injection')Packagist · wnx/laravel-backup-restore · fixed in 1.9.4
- CVE-2026-63464Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`Go · github.com/forgekeep/nebula-mesh · fixed in 0.7.2
- CVE-2026-61699nebula-mesh: Certificate revocation is never enforced at the meshGo · github.com/forgekeep/nebula-mesh · fixed in 0.7.1
- CVE-2026-55513nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokensGo · github.com/forgekeep/nebula-mesh, github.com/juev/nebula-mesh · fixed in 0.5.0
- CVE-2026-55512nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limitingGo · github.com/forgekeep/nebula-mesh, github.com/juev/nebula-mesh · fixed in 0.5.0
- CVE-2026-53604nebula-mesh: CA private key not zeroized on web mobile-bundle error pathsGo · github.com/forgekeep/nebula-mesh · fixed in 0.3.8
- CVE-2026-53603nebula-mesh: Operator session tokens stored in plaintext in the databaseGo · github.com/forgekeep/nebula-mesh · fixed in 0.3.8
- CVE-2026-53602nebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificateGo · github.com/forgekeep/nebula-mesh · fixed in 0.3.7