Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-82394Sulu: Fix authorization bypass when creating preview linksPackagist · sulu/sulu · fixed in 2.6.25, 3.0.8
- CVE-2026-82393pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on installnpm · pnpm · fixed in 10.34.5, 11.11.0
- CVE-2026-82392pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraphnpm · pnpm · fixed in 10.34.5, 11.11.0
- CVE-2026-62993Smarty: SSRF via redirect bypass of trusted_uri using {fetch}Packagist · smarty/smarty · fixed in 5.8.2, 4.5.7
- CVE-2026-75594Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handlingPackagist · getkirby/cms · fixed in 4.9.5, 5.5.2
- CVE-2026-75592Kirby: Access to image files outside of the site root via path traversal in the media handlingPackagist · getkirby/cms · fixed in 4.9.5, 5.5.2
- CVE-2026-71415Kirby: File upload permissions are not checked during processing of chunk dataPackagist · getkirby/cms · fixed in 5.5.2
- CVE-2026-81892EasyAdmin custom-action dispatcher bypasses access_control on other routesPackagist · easycorp/easyadmin-bundle · fixed in 4.29.16, 5.5.1
- CVE-2026-81891elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)Packagist · studio-42/elfinder · fixed in 2.1.70
- CVE-2026-81890elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connectionsPackagist · studio-42/elfinder · fixed in 2.1.70
- CVE-2026-81888@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linkingnpm · @hono/oauth-providers · fixed in 0.8.6
- CVE-2026-81889elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallbackPackagist · studio-42/elfinder · fixed in 2.1.70
- CVE-2026-81887Livewire DOM-based cross-site scripting during client-side state handlingPackagist · livewire/livewire · fixed in 3.8.3, 4.3.4
- CVE-2026-54179backpack/crud: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public diskPackagist · backpack/crud · fixed in 6.8.14, 7.0.38
- CVE-2026-53508oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)Go · github.com/oasdiff/oasdiff · fixed in 1.18.1
- CVE-2026-53553Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server CompromiseGo · github.com/zhenorzz/goploy · fixed in 1.18.0
- CVE-2026-53552Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlersGo · github.com/zhenorzz/goploy · fixed in 1.18.0
- CVE-2026-79743MCPHub: Path Traversal via Malicious MCPB Manifest Namenpm · @samanhappy/mcphub · fixed in 0.12.13
- CVE-2026-78422zbus_polkit: polkit authorization bypass via PID reuse due to incorrect D-Bus type for the subject UIDcrates.io · zbus_polkit · fixed in 5.1.0
- CVE-2026-82868@pdfme/schemas before 5.5.9 Cross-Site Scripting via SVGnpm · @pdfme/schemas · fixed in 5.5.9
- CVE-2026-82867@pdfme/schemas before 5.5.9 Cross-Site Scripting via Selectnpm · @pdfme/schemas · fixed in 5.5.9
- CVE-2026-82866@pdfme/common before 5.5.10 SSRF via Unvalidated URL Fetchnpm · @pdfme/common · fixed in 5.5.10
- CVE-2026-82865pdfme schemas before 5.5.10 Cross-Site Scripting via i18n Labelnpm · @pdfme/schemas · fixed in 5.5.10
- CVE-2026-82864pdfme pdf-lib before 5.5.10 Denial of Service via Decompression Bombnpm · @pdfme/pdf-lib · fixed in 5.5.10
- CVE-2026-82863@hulumi/baseline before 1.3.2 CloudTrail Selector Tampering Detectionnpm · @hulumi/baseline · fixed in 1.3.2
- CVE-2026-82861@hulumi/policies before 1.3.2 SecureBucket Parent Spoof Bypassnpm · @hulumi/policies · fixed in 1.3.2
- CVE-2026-82860@hulumi/policies before 1.3.2 Admin Policy Bypassnpm · @hulumi/policies · fixed in 1.3.2
- CVE-2026-82858@hulumi/drift before 1.3.2 Unsafe Execute Plan Acceptancenpm · @hulumi/drift · fixed in 1.3.2
- CVE-2026-82856@hulumi/policies before 1.3.2 OIDC Trust Policy Bypassnpm · @hulumi/policies · fixed in 1.3.2
- CVE-2026-82855@hulumi/policies before 1.3.2 Evidence Validation Bypassnpm · @hulumi/policies · fixed in 1.3.2