Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-91982Vikunja before 2.6.0 TOTP Secret Disclosure via APIGo · code.vikunja.io/api · fixed in 2.6.0
- CVE-2026-91981Vikunja before 2.6.0 User Enumeration via v2 APIGo · code.vikunja.io/api · fixed in 2.6.0
- CVE-2026-91980vikunja before 2.6.0 Team Enumeration via Project ShareGo · code.vikunja.io/api · fixed in 2.6.0
- CVE-2026-91979Vikunja before 2.6.0 Denial of Service via Decompression BombGo · code.vikunja.io/api · fixed in 2.6.0
- CVE-2026-91973Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuthGo · code.vikunja.io/api · fixed in 2.6.0
- CVE-2026-91972Vikunja before 2.6.0 Authentication Bypass via Unthrottled APIGo · code.vikunja.io/api · fixed in 2.6.0
- CVE-2026-91971Vikunja before 2.6.0 Denial of Service via Avatar UploadGo · code.vikunja.io/api · fixed in 2.6.0
- CVE-2026-91970Vikunja before 2.6.0 Resource Exhaustion via Planka MigrationGo · code.vikunja.io/api · fixed in 2.6.0
- CVE-2026-91969vikunja before 2.6.0 Resource Exhaustion via CSV MigrationGo · code.vikunja.io/api · fixed in 2.6.0
- CVE-2026-91968vikunja before 2.6.0 Denial of Service via unbounded filter recursionGo · code.vikunja.io/api · fixed in 2.6.0
- CVE-2026-55828qbee transport: Symlink-chain path traversal in tar extraction (one level outside destination)Go · go.qbee.io/transport · fixed in 1.26.25
- CVE-2026-47215Singularity: Incorrect path matching for 'limit container paths' directiveGo · github.com/sylabs/singularity, github.com/sylabs/singularity/v4 · fixed in 4.4.2
- CVE-2026-55701OpenTelemetry githubreceiver silently ignores configured required_headers authenticationGo · github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver · fixed in 0.151.0
- CVE-2026-61549Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backendGo · github.com/woodpecker-ci/woodpecker, go.woodpecker-ci.org/woodpecker +2 · fixed in 3.16.0
- CVE-2026-50166Kuma: kumactl connects to control plane without verifying TLS certificate when no CA is configuredGo · github.com/kumahq/kuma, github.com/kumahq/kuma/v2 · fixed in 2.7.26, 2.11.14, 2.12.11 and more
- CVE-2026-52724kuma-dp connects to control plane without verifying TLS certificate when no CA is configuredGo · github.com/kumahq/kuma, github.com/kumahq/kuma/v2 · fixed in 2.7.26, 2.9.16, 2.11.14 and more
- CVE-2026-47780free5GC: UDR Improper ueId validation in free5GC EE subscription handlers allows arbitrary identifier persistenceGo · github.com/free5gc/udr
- CVE-2026-49446Cosmos: Authentication bypass via forward-auth header smuggling on Constellation tunnel in Cosmos-ServerGo · github.com/azukaar/cosmos-server · fixed in 0.22.19
- CVE-2026-54167Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host headerGo · github.com/openshift-pipelines/pipelines-as-code · fixed in 0.48.0, 0.42.1, 0.39.6 and more
- CVE-2026-54168Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolutionGo · github.com/openshift-pipelines/pipelines-as-code · fixed in 0.37.8, 0.39.6, 0.42.1 and more
- CVE-2026-49254Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauthGo · d7y.io/dragonfly/v2 · fixed in 2.4.4
- CVE-2026-54637Dragonfly scheduler v1 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFileGo · d7y.io/dragonfly/v2 · fixed in 2.4.4-rc.3
- CVE-2026-76081ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role DeletionsGo · github.com/zitadel/zitadel · fixed in 4.16.0
- CVE-2026-53714Envoy Gateway: xDS Control Plane Information Disclosure when Envoy Gateway operates in GatewayNamespaceModeGo · github.com/envoyproxy/gateway · fixed in 1.8.1, 1.7.4
- CVE-2026-53716Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limitGo · github.com/envoyproxy/gateway · fixed in 1.8.1, 1.7.4
- CVE-2026-53715Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lockGo · github.com/envoyproxy/gateway · fixed in 1.8.1, 1.7.4
- CVE-2026-53719Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorizationGo · github.com/envoyproxy/gateway · fixed in 1.7.4, 1.8.1
- CVE-2026-53718Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypassGo · github.com/envoyproxy/gateway · fixed in 1.8.1, 1.7.4
- CVE-2026-53713Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret DisclosureGo · github.com/envoyproxy/gateway · fixed in 1.7.4, 1.8.1
- CVE-2026-53717Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar headerGo · github.com/envoyproxy/gateway · fixed in 1.7.4, 1.8.1