Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-77405RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI ParserGo · github.com/rabbitmq/amqp091-go · fixed in 1.13.0
- CVE-2026-77404RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter InjectionGo · github.com/rabbitmq/amqp091-go · fixed in 1.13.0
- CVE-2026-77410RabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer AllocationGo · github.com/rabbitmq/amqp091-go · fixed in 1.13.0
- CVE-2026-77406RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos ConfigurationGo · github.com/rabbitmq/amqp091-go · fixed in 1.13.0
- CVE-2026-77403RabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size NegotiationGo · github.com/rabbitmq/amqp091-go · fixed in 1.13.0
- CVE-2026-77407RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct FieldsGo · github.com/rabbitmq/amqp091-go · fixed in 1.13.0
- CVE-2026-77408RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer OverflowGo · github.com/rabbitmq/amqp091-go · fixed in 1.13.0
- CVE-2026-61709OpenFGA: ListUsers returns a deliberately-excluded user (authorization-decision over-inclusion) when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that userGo · github.com/openfga/openfga · fixed in 1.18.1
- CVE-2026-8462OpenMeter SQL Injection in ClickHouse-backed Meter DefinitionsGo · github.com/openmeterio/openmeter · fixed in 1.0.0-beta.228
- CVE-2026-61554emp3r0r has an unauthenticated HTTP Polling DoSGo · github.com/jm33-m0/emp3r0r/core · fixed in 0.0.0-20260531142011-aed3d81641ab
- CVE-2026-32599Netmaker has a boolean‑based SQL InjectionGo · github.com/gravitl/netmaker · fixed in 1.5.0
- CVE-2026-48785Apptainer: Incorrect path matching for 'limit container paths' directiveGo · github.com/apptainer/apptainer · fixed in 1.5.1
- CVE-2026-44300OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/InjectionGo · github.com/opencost/opencost · fixed in 1.119.1
- CVE-2026-53941Inspektor Gadget Uprobe gadgets: unprivileged container's ld.so.cache causes high CPU utilization and container startup DoSGo · github.com/inspektor-gadget/inspektor-gadget · fixed in 0.53.1
- CVE-2026-44778Inspektor Gadget: Unprivileged container can crash USDT note parser via crafted ELFGo · github.com/inspektor-gadget/inspektor-gadget · fixed in 0.53.1
- CVE-2026-63443Coder: Workspace agent API insecure redirect handling allowed cross-agent file read and writeGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.29.19, 2.32.9, 2.33.10 and more
- CVE-2026-53658Fabric CA: LDAP Injection via Unescaped Username in GetUser FilterGo · github.com/hyperledger/fabric-ca · fixed in 1.5.21
- CVE-2026-55149Vouch Proxy: Unbounded Multipart Cookie Allocation DoSGo · github.com/vouch/vouch-proxy · fixed in 0.48.0
- CVE-2026-58196ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation)Go · github.com/stacklok/toolhive · fixed in 0.31.0
- CVE-2026-54450ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gatewayGo · github.com/stacklok/toolhive · fixed in 0.29.1
- CVE-2026-59157webhookd: Unrestricted HTTP Header to Shell Variable InjectionGo · github.com/ncarlier/webhookd · fixed in 1.22.0
- CVE-2026-55887MCP Gateway: Argument injection via OCI image label YAML in Docker MCP GatewayGo · github.com/docker/mcp-gateway · fixed in 0.42.2
- CVE-2026-55770OpenBao: LDAPi ldaputil (wrong escape func)Go · github.com/openbao/openbao · fixed in 0.0.0-20260617104213-10b7825c714c
- CVE-2026-55776OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key typesGo · github.com/openbao/openbao · fixed in 0.0.0-20260617104123-db57c62602b2
- CVE-2026-55774OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808Go · github.com/openbao/openbao · fixed in 0.0.0-20260617103932-b20b999dd404
- CVE-2026-55775OpenBao's System Backend allows Unauthorized Management of the containing NamespaceGo · github.com/openbao/openbao · fixed in 0.0.0-20260617103935-d3c1cc64b1ae
- CVE-2026-55636Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotectedGo · github.com/projectcapsule/capsule · fixed in 0.13.6
- CVE-2026-91985Vikunja before 2.6.0 Privilege Escalation via Link Share HashGo · code.vikunja.io/api · fixed in 2.6.0
- CVE-2026-91984Vikunja before 2.6.0 Broken Object-Level Authorization via task-positionGo · code.vikunja.io/api · fixed in 2.6.0
- CVE-2026-91983Vikunja before 2.6.0 API Token Scope Bypass via expand ParameterGo · code.vikunja.io/api · fixed in 2.6.0