Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-76803Nuclei: Local File Read via MySQL Client Sandbox BypassGo · github.com/projectdiscovery/nuclei, github.com/projectdiscovery/nuclei/v2 +1 · fixed in 3.10.0
- CVE-2026-88010Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracleGo · github.com/traefik/traefik, github.com/traefik/traefik/v3 +1 · fixed in 3.7.13
- CVE-2026-77637Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth ScopeGo · github.com/cloudreve/cloudreve, github.com/cloudreve/cloudreve/v3 +1 · fixed in 4.0.0-20260715070110-bce08f88e9d8
- CVE-2026-77633Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of serviceGo · github.com/cloudreve/cloudreve, github.com/cloudreve/cloudreve/v3 +1 · fixed in 4.0.0-20260715025621-7329602751c0
- CVE-2026-79913Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addressesGo · github.com/cloudreve/cloudreve, github.com/cloudreve/cloudreve/v3 +1 · fixed in 4.0.0-20260715072853-1c5cad6dec7e
- CVE-2026-62182KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodesGo · github.com/kubeedge/kubeedge · fixed in 1.21.2, 1.22.2, 1.23.1
- CVE-2026-62369KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node joinGo · github.com/kubeedge/kubeedge · fixed in 1.21.2, 1.22.2, 1.23.1
- CVE-2026-62370KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHubGo · github.com/kubeedge/kubeedge · fixed in 1.21.2, 1.22.2, 1.23.1
- CVE-2026-62371KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 APIGo · github.com/kubeedge/kubeedge · fixed in 1.21.2, 1.22.2, 1.23.1
- CVE-2026-59168Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoSGo · github.com/tomwright/dasel, github.com/tomwright/dasel/v2 +1 · fixed in 3.11.1
- CVE-2026-62866Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`Go · github.com/tomwright/dasel, github.com/tomwright/dasel/v2 +1 · fixed in 3.11.2
- CVE-2026-77561Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of serviceGo · github.com/steveiliop56/tinyauth, github.com/tinyauthapp/tinyauth · fixed in 1.0.1-0.20260715123057-dade1e2c8f27
- CVE-2026-77582Tinyauth: User enumeration attack by timing oracleGo · github.com/tinyauthapp/tinyauth · fixed in 1.0.1-0.20260714134959-c22925c2fba9
- CVE-2026-77560Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist forGo · github.com/tinyauthapp/tinyauth · fixed in 1.0.1-0.20260720133915-80bc87188ec3
- CVE-2026-62987Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection headerGo · github.com/fabiolb/fabio · fixed in 1.7.2
- CVE-2026-88978Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filterGo · github.com/hatchet-dev/hatchet · fixed in 0.106.1
- CVE-2026-84298Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 DispatcherGo · github.com/hatchet-dev/hatchet · fixed in 0.95.3
- CVE-2026-61687hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthStateGo · github.com/hatchet-dev/hatchet, hatchet · fixed in 0.91.1
- CVE-2026-63342Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization CheckGo · github.com/hatchet-dev/hatchet · fixed in 0.91.1
- CVE-2026-61681Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation HandlerGo · github.com/hatchet-dev/hatchet · fixed in 0.91.1, 0.91.2
- CVE-2026-71543OpenBao's Templated Policies Allow Privilege Escalation via Wildcard CharactersGo · github.com/openbao/openbao · fixed in 0.0.0-20260710001938-2d4ebafec5c5
- CVE-2026-61628nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race ConditionGo · github.com/lucasdillmann/nginx-ignition · fixed in 0.0.0-20260621194639-0586b4e55ab
- CVE-2026-61629nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddlewareGo · github.com/lucasdillmann/nginx-ignition · fixed in 0.0.0-20260526022344-0c988fc1277c
- CVE-2026-61630nginx ignition has TOTP Reuse During Validity WindowGo · github.com/lucasdillmann/nginx-ignition · fixed in 0.0.0-20260328015550-8d35e1eb5dd6
- CVE-2026-63445Perses: Unvalidated project parameter enables filesystem path traversalGo · github.com/perses/perses · fixed in 0.54.0-rc.0
- CVE-2026-63199Perses: Missing authorization in datasource proxy allows cross-scope secret disclosureGo · github.com/perses/perses · fixed in 0.54.0-rc.0
- CVE-2026-63458Perses project query parameter authorization bypass exposes cross-project resourcesGo · github.com/perses/perses · fixed in 0.54.0-beta.3
- CVE-2026-61833zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletionGo · zotregistry.dev/zot, zotregistry.dev/zot/v2 · fixed in 2.1.18
- CVE-2026-63406AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including SecretsGo · github.com/anycable/anycable, github.com/anycable/anycable-go · fixed in 1.6.15
- CVE-2026-63405AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary BodyGo · github.com/anycable/anycable, github.com/anycable/anycable-go · fixed in 1.6.15