Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-84376Astro: Authorization bypass from missing path-segment boundary check when stripping the configured basenpm · astro · fixed in 7.2.4
- CVE-2026-45730Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any projectGo · github.com/nuclio/nuclio · fixed in 0.0.0-20260513101907-1915cd26d514
- CVE-2026-53600async-tar PAX extension-header desync enables tar entry/content smugglingcrates.io · async-tar · fixed in 0.6.1
- CVE-2026-79989Arbitrary user password reset leading to administrator account takeoverPackagist · craftcms/cms · fixed in 5.10.8
- CVE-2026-16647Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111Packagist · drupal/disable_login · fixed in 1.1.4
- CVE-2026-18986Entity Browser - Moderately critical - Cross site scripting - SA-CONTRIB-2026-094Packagist · drupal/entity_browser · fixed in 2.16.0
- CVE-2026-73475Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095Packagist · drupal/commerce_paypal · fixed in 1.12.0, 2.1.3
- CVE-2026-73478Diff - Moderately critical - Access bypass - SA-CONTRIB-2026-096Packagist · drupal/diff · fixed in 2.0.1, 2.1.1
- CVE-2026-73474Entity Share Websub - Moderately critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097Packagist · drupal/entity_share_websub · fixed in 1.1.2
- CVE-2026-73476External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098Packagist · drupal/externalauth · fixed in 2.0.13
- CVE-2026-73477Quick Tabs - Moderately critical - Access bypass - SA-CONTRIB-2026-099Packagist · drupal/quicktabs · fixed in 4.3.1
- CVE-2026-76757Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100Packagist · drupal/gammu_smsd
- CVE-2026-76756Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100Packagist · drupal/gammu_smsd
- CVE-2026-76755Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100Packagist · drupal/gammu_smsd
- CVE-2026-76758Link content parser - Critical - Unsupported - SA-CONTRIB-2026-101Packagist · drupal/postlight_parser
- CVE-2026-76782Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102Packagist · drupal/screenshot
- CVE-2026-76759Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102Packagist · drupal/screenshot
- CVE-2026-81167Address Suggestion - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-103Packagist · drupal/address_suggestion · fixed in 1.0.25
- CVE-2026-81165Blazy - Less critical - Access bypass - SA-CONTRIB-2026-104Packagist · drupal/blazy · fixed in 3.0.18
- CVE-2026-81168CAPTCHA Protected Page - Moderately critical - Cookie Forgery - SA-CONTRIB-2026-105Packagist · drupal/captcha_protected_page · fixed in 1.0.2
- CVE-2026-81159Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106Packagist · drupal/commerce_cybersource · fixed in 1.10.0
- CVE-2026-81161Content Moderation Notifications - Moderately critical - Access bypass - SA-CONTRIB-2026-107Packagist · drupal/content_moderation_notifications · fixed in 3.9.0
- CVE-2026-81269Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108Packagist · drupal/datafield · fixed in 2.0.13
- CVE-2026-81166Digital Signage Framework - Moderately critical - Access bypass - SA-CONTRIB-2026-109Packagist · drupal/digital_signage_framework · fixed in 2.6.1
- CVE-2026-81162DXPR Builder: The AI Visual Page Builder for Drupal - Moderately critical - Information Disclosure - SA-CONTRIB-2026-112Packagist · drupal/dxpr_builder · fixed in 2.8.1
- CVE-2026-81158Entity API - Moderately critical - Information disclosure - SA-CONTRIB-2026-113Packagist · drupal/entity · fixed in 1.8.0
- CVE-2026-81164Entity PDF - Moderately critical - Access bypass - SA-CONTRIB-2026-114Packagist · drupal/entity_pdf · fixed in 2.1.5
- CVE-2026-81205LDAP / Active Directory Integration - Moderately critical - Information Disclosure - SA-CONTRIB-2026-115Packagist · drupal/ldap_auth · fixed in 2.2.1
- CVE-2026-81201Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116Packagist · drupal/monster_menus · fixed in 9.5.3
- CVE-2026-81160Slick Carousel - Moderately critical - Cross Site Scripting - SA-CONTRIB-2026-117Packagist · drupal/slick · fixed in 2.1.0