Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-87857Temporal Server workflow-history pagination token is not bound to the requested namespace and workflowGo · go.temporal.io/server · fixed in 1.30.7, 1.31.3
- CVE-2026-123616imgproxy 3.3.0 before 4.0.16 Memory Exhaustion DoS via ICO LoaderGo · github.com/imgproxy/imgproxy, github.com/imgproxy/imgproxy/v2 +2 · fixed in 4.0.16
- CVE-2026-123615imgproxy before 4.0.17 Out-of-Bounds Write in ICO LoaderGo · github.com/imgproxy/imgproxy, github.com/imgproxy/imgproxy/v2 +2 · fixed in 4.0.17
- CVE-2026-123614imgproxy 4.0.0 before 4.0.16 Heap Buffer Overflow via ICO Loader Integer OverflowGo · github.com/imgproxy/imgproxy, github.com/imgproxy/imgproxy/v2 +2 · fixed in 4.0.16
- CVE-2026-102657esm.sh: web.NewHandler allows arbitrary file read via encoded dot-segment path traversalGo · github.com/esm-dev/esm.sh/web · fixed in 0.2.0
- CVE-2026-85737Velociraptor: Low-priv analyst reads arbitrary server files via ungated sql() VQL pluginGo · www.velocidex.com/golang/velociraptor · fixed in 0.77.2
- GHSA-47W9-6R3F-938GLXD has restricted project bypass leading to arbitrary command executionGo · github.com/canonical/lxd · fixed in 0.0.0-20260630083100-c5184be310b1
- GHSA-7MR3-28H5-M5VXLXD has project restriction bypass for custom volume copy across projectsGo · github.com/canonical/lxd · fixed in 0.0.0-20260630083100-c5184be310b1
- GHSA-QX75-2P3R-PWM5LXD has project restriction bypass in instance copy across projectsGo · github.com/canonical/lxd · fixed in 0.0.0-20260630083100-c5184be310b1
- GHSA-PJFF-C2WC-F6JMLXD has arbitrary file write on client due to trusted image hashGo · github.com/canonical/lxd · fixed in 0.0.0-20260630083100-c5184be310b1
- GHSA-FMC8-P6Q7-75CCLXD has argument injection in backup compression algorithm leading to AFW and ACEGo · github.com/canonical/lxd · fixed in 0.0.0-20260630083100-c5184be310b1
- GHSA-VGHH-5RFX-XHQ8LXD has arbitrary file read+write on host via rootfs/ symlink in malicious imageGo · github.com/canonical/lxd · fixed in 0.0.0-20260630083100-c5184be310b1
- GHSA-JPF8-86F3-WP38LXD has arbitrary file read+write on host via templates/ symlink in malicious imageGo · github.com/canonical/lxd · fixed in 0.0.0-20260203144152-d1c8ba15d160
- GHSA-9J25-MM2H-2F76LXD has arbitrary file write on host via `exec-output` symlink in crafted imageGo · github.com/canonical/lxd · fixed in 0.0.0-20260626085134-124f90100640
- CVE-2026-108262DDEV incomplete tar symlink traversal fix allows host file overwrite - Incomplete fix of CVE-2026-32885Go · github.com/ddev/ddev · fixed in 1.25.4
- GO-2026-6893Event type spoofing via UntrustedType in github.com/google/go-eventlogGo · github.com/google/go-eventlog · fixed in 0.0.3-0.20261001001437-1991f15bc4b0
- GO-2026-6905Panic on negative member size in Reader.Read in github.com/blakesmith/arGo · github.com/blakesmith/ar
- GO-2026-6909Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/samlGo · github.com/crewjam/saml
- GO-2026-6911SSRF and credential leak via unvalidated Location header in github.com/mark3labs/mcp-goGo · github.com/mark3labs/mcp-go
- GO-2026-6906Netfoil doesn't decrement TTL in github.com/tinfoil-factory/netfoilGo · github.com/tinfoil-factory/netfoil · fixed in 0.6.1
- GO-2026-6907Arc has unauthenticated application log disclosure via `/api/v1/logs` in github.com/basekick-labs/arcGo · github.com/basekick-labs/arc · fixed in 0.0.0-20260615165136-bb7d9761ad98
- GO-2026-6894anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS in…Go · github.com/anacrolix/torrent · fixed in 1.61.1-0.20260911233437-76452a2c8a2f
- GO-2026-6891charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users in…Go · github.com/charmbracelet/soft-serve · fixed in 0.12.3
- GO-2026-6892charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories in github.com/charmbracelet/soft-serveGo · github.com/charmbracelet/soft-serve · fixed in 0.12.3
- GO-2026-6836SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized in…Go · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260729005258-4daee87d4152
- GO-2026-6838Echo: WebSocket proxy can retain connections and handlers after client disconnect in github.com/labstack/echoGo · github.com/labstack/echo/v4, github.com/labstack/echo/v5 · fixed in 4.16.1, 5.4.1
- GO-2026-6839Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echoGo · github.com/labstack/echo/v4, github.com/labstack/echo/v5 · fixed in 4.16.1, 5.4.1
- GO-2026-6840Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echoGo · github.com/labstack/echo/v4 · fixed in 4.16.1
- GO-2026-6841Echo: X-Real-IP extractor trusts the header value instead of the sending peer in github.com/labstack/echoGo · github.com/labstack/echo/v5 · fixed in 5.4.1
- GO-2026-6842Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echoGo · github.com/labstack/echo/v4 · fixed in 4.16.1