Incidents
Developer-focused advisories from OSV and CISA KEV, enriched with EPSS exploit probability. Search by package, CVE, or advisory — or browse an ecosystem hub.
A Blackstone real estate company exposed SSN digits, DOBs, addresses and more
jss: jss: JSSTrustManager does not verify NSS trust flags on CA certificates
jss: jss: JSSTrustManager does not verify NSS trust flags on CA certificates
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
https://www.oracle.com/security-alerts/cpujan2026.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-21962
Moon (2024)
Panic-safety unsoundness in `BitVecCore::clear` (double-free / use-after-free)
Panic-safety unsoundness in `BitVecCore::clear` (double-free / use-after-free)
Sakai Conversations has a Stored XSS Issue
Sakai Conversations has a Stored XSS Issue
org.sakaiproject.conversations:sakai-conversations-impl: ≥ 23.0
postgres-protocol: Panic decoding a malformed `hstore` value allows denial of service
postgres-protocol: Panic decoding a malformed `hstore` value allows denial of service
tokio-postgres: Panic on a `DataRow` with fewer fields than columns allows denial of service
tokio-postgres: Panic on a `DataRow` with fewer fields than columns allows denial of service
Sakai Profile Image Deletion has an IDOR
Sakai Profile Image Deletion has an IDOR
org.sakaiproject.profile2:profile2-api: 23.0 → 23.5
postgres-protocol: Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service
postgres-protocol: Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service
vibeio-http has a DoS vulnerability in HTTP/1.x chunked encoding parser triggered by maliciously crafted chunk lengths
vibeio-http has a DoS vulnerability in HTTP/1.x chunked encoding parser triggered by maliciously crafted chunk lengths
netfoil vulnerable to improper handling of untrusted DoH response data
netfoil vulnerable to improper handling of untrusted DoH response data
Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key
Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key
Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context_hint
Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context_hint
3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation
3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation
Cloudreve's remote download file paths can escape the selected destination directory
Cloudreve's remote download file paths can escape the selected destination directory
Malicious code in multyproccess (PyPI)
Malicious code in multyproccess (PyPI)
mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server
mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server
mcp-contextforge-gateway: before 1.0.2
Malicious code in msrcpoc (PyPI)
Malicious code in msrcpoc (PyPI)
django CMS: Plugin move endpoint allows cyclic reparenting (DoS)
django CMS: Plugin move endpoint allows cyclic reparenting (DoS)
django-cms: before 5.0.8
Malicious code in agentgui (npm)
Malicious code in agentgui (npm)
django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)
django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)
django-cms: before 5.0.8
Malicious code in livemcp (npm)
Malicious code in livemcp (npm)
Malicious code in dext-crate-video (npm)
Malicious code in dext-crate-video (npm)
Malicious code in polis-diraja (npm)
Malicious code in polis-diraja (npm)
Malicious code in react-dynamic-parser (npm)
Malicious code in react-dynamic-parser (npm)
Malicious code in react-emits (npm)
Malicious code in react-emits (npm)
Malicious code in create-json-client (npm)
Malicious code in create-json-client (npm)
Malicious code in mcp-real-chrome (npm)
Malicious code in mcp-real-chrome (npm)
Malicious code in dext-crate-image (npm)
Malicious code in dext-crate-image (npm)
Malicious code in @deepaksilaych/sess (npm)
Malicious code in @deepaksilaych/sess (npm)
Malicious code in dext-crate-check (npm)
Malicious code in dext-crate-check (npm)
Malicious code in tkyoussef-hb (npm)
Malicious code in tkyoussef-hb (npm)
Malicious code in sm-oauth (npm)
Malicious code in sm-oauth (npm)
Malicious code in chai-as-mno (npm)
Malicious code in chai-as-mno (npm)
Malicious code in dims-svelte-ui (npm)
Malicious code in dims-svelte-ui (npm)
Malicious code in @medisend/auth (npm)
Malicious code in @medisend/auth (npm)
Malicious code in svelte-dim-ui (npm)
Malicious code in svelte-dim-ui (npm)
Malicious code in @temptation.js/utils (npm)
Malicious code in @temptation.js/utils (npm)
Malicious code in @medisend/shared (npm)
Malicious code in @medisend/shared (npm)
Malicious code in @medisend/core (npm)
Malicious code in @medisend/core (npm)
Malicious code in auth-otp (npm)
Malicious code in auth-otp (npm)
Malicious code in dims-hydration-ui (npm)
Malicious code in dims-hydration-ui (npm)
Malicious code in babel-polyfill-plugin-corejs2 (npm)
Malicious code in babel-polyfill-plugin-corejs2 (npm)
Malicious code in dpg-media-7ehemel (npm)
Malicious code in dpg-media-7ehemel (npm)
Malicious code in manticore-log (npm)
Malicious code in manticore-log (npm)
Malicious code in paypal-business-sdk (npm)
Malicious code in paypal-business-sdk (npm)
Malicious code in dotish (npm)
Malicious code in dotish (npm)
Malicious code in kelly-stake-sizing (npm)
Malicious code in kelly-stake-sizing (npm)
Malicious code in remove-bg-serverless-azure (npm)
Malicious code in remove-bg-serverless-azure (npm)
Malicious code in poly-price-node (npm)
Malicious code in poly-price-node (npm)
Malicious code in openai-pr-reviewer (npm)
Malicious code in openai-pr-reviewer (npm)
Malicious code in dim-hydration-ui (npm)
Malicious code in dim-hydration-ui (npm)
Malicious code in secret-key-totp (npm)
Malicious code in secret-key-totp (npm)
Malicious code in @blurrydespair/libsignal-node (npm)
Malicious code in @blurrydespair/libsignal-node (npm)
Malicious code in web-advertising (npm)
Malicious code in web-advertising (npm)
Malicious code in hydration-ui-dim (npm)
Malicious code in hydration-ui-dim (npm)
Malicious code in message-compiler (npm)
Malicious code in message-compiler (npm)
Malicious code in amundi-compare (npm)
Malicious code in amundi-compare (npm)
Malicious code in consumerweb-serverutils (npm)
Malicious code in consumerweb-serverutils (npm)
Malicious code in @elc-online/up-analytics (npm)
Malicious code in @elc-online/up-analytics (npm)
Malicious code in fund-calculator (npm)
Malicious code in fund-calculator (npm)
Malicious code in @gsas/gsas-sdk (npm)
Malicious code in @gsas/gsas-sdk (npm)
Malicious code in ppb-manticore (npm)
Malicious code in ppb-manticore (npm)
Malicious code in hydration-dim-ui (npm)
Malicious code in hydration-dim-ui (npm)
Malicious code in @medisend/webview-bridge (npm)
Malicious code in @medisend/webview-bridge (npm)
Malicious code in svelte-ui-dim (npm)
Malicious code in svelte-ui-dim (npm)
Malicious code in sm-session (npm)
Malicious code in sm-session (npm)
Malicious code in sm-admin (npm)
Malicious code in sm-admin (npm)
Malicious code in sm-checkout (npm)
Malicious code in sm-checkout (npm)
Malicious code in sm-payment (npm)
Malicious code in sm-payment (npm)
Malicious code in sm-billing-form (npm)
Malicious code in sm-billing-form (npm)
Malicious code in sm-cart (npm)
Malicious code in sm-cart (npm)
Malicious code in sm-apikey-model (npm)
Malicious code in sm-apikey-model (npm)
Malicious code in cryptgraphy (PyPI)
Malicious code in cryptgraphy (PyPI)
Malicious code in envprovision (PyPI)
Malicious code in envprovision (PyPI)
Malicious code in mlflow-otel-instrumentor (PyPI)
Malicious code in mlflow-otel-instrumentor (PyPI)
Malicious code in @sdgdfgdfhhhfd/multiviewr (npm)
Malicious code in @sdgdfgdfhhhfd/multiviewr (npm)
Malicious code in svelte-dim-kit (npm)
Malicious code in svelte-dim-kit (npm)
Malicious code in @opap/player-kyc-widget (npm)
Malicious code in @opap/player-kyc-widget (npm)
Malicious code in hydration-dim-kit (npm)
Malicious code in hydration-dim-kit (npm)
Malicious code in @sdgdfgdfhhhfd/chainvista (npm)
Malicious code in @sdgdfgdfhhhfd/chainvista (npm)
Malicious code in fund-list-filter (npm)
Malicious code in fund-list-filter (npm)
US Military newspaper editor voices censorship fears after being fired
Malicious code in 3-buildsight-web (npm)
Malicious code in 3-buildsight-web (npm)
Malicious code in 10-shardsight-web (npm)
Malicious code in 10-shardsight-web (npm)
Malicious code in 2-loadsight-web (npm)
Malicious code in 2-loadsight-web (npm)
Malicious code in hatdhat-testkit (npm)
Malicious code in hatdhat-testkit (npm)
Malicious code in 8-fetchsight-web (npm)
Malicious code in 8-fetchsight-web (npm)
Malicious code in @syncraft-labs/core (npm)
Malicious code in @syncraft-labs/core (npm)
Malicious code in chai-as-testkit (npm)
Malicious code in chai-as-testkit (npm)
Malicious code in stillm4ddpocs-demo-sprocket (npm)
Malicious code in stillm4ddpocs-demo-sprocket (npm)
Malicious code in 6-viewsight-web (npm)
Malicious code in 6-viewsight-web (npm)
Malicious code in stillm4ddpocs-rtest-bravo (npm)
Malicious code in stillm4ddpocs-rtest-bravo (npm)
Malicious code in @syncraft-labs/vue (npm)
Malicious code in @syncraft-labs/vue (npm)
Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)
Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)
Malicious code in rust-testing-utils (npm)
Malicious code in rust-testing-utils (npm)
Malicious code in solidity-testing-utils (npm)
Malicious code in solidity-testing-utils (npm)
Malicious code in stillm4ddpocs-rtest-alpha (npm)
Malicious code in stillm4ddpocs-rtest-alpha (npm)
Malicious code in fund-portfolio (npm)
Malicious code in fund-portfolio (npm)