Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-54247Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoSGo · github.com/zalando/skipper · fixed in 0.26.22
- CVE-2026-54246Skipper routesrv-no-auth: All routesrv API Endpoints Lack AuthenticationGo · github.com/zalando/skipper · fixed in 0.27.13
- CVE-2026-65838Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstreamGo · github.com/zalando/skipper · fixed in 0.27.26
- CVE-2026-54628Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server ModeGo · github.com/julien040/anyquery
- CVE-2026-50006Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server ModeGo · github.com/julien040/anyquery
- CVE-2026-54629Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server ModeGo · github.com/julien040/anyquery
- CVE-2026-47253Anyquery: Path Traversal in `clear_plugin_cache` Allows Arbitrary Directory DeletionGo · github.com/julien040/anyquery · fixed in 0.4.5
- CVE-2026-47256OpenTelemetry: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer tokenGo · github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter · fixed in 0.154.0
- CVE-2026-55866SpiceDBChecks involving relations with caveats can result in unconditional permission when conditional permission is expectedGo · github.com/authzed/spicedb · fixed in 1.54.0
- CVE-2026-53495containerd CRI ExecSync Goroutine Leak Leading to Node-Level Denial of ServiceGo · github.com/containerd/containerd, github.com/containerd/containerd/v2 · fixed in 1.7.35, 2.0.12, 2.2.8 and more
- CVE-2026-54452safeurl: Missing IPv6 CIDR Ranges in BlocklistGo · github.com/doyensec/safeurl · fixed in 0.2.4
- CVE-2026-84445gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS serversGo · google.golang.org/grpc · fixed in 1.82.2, 1.83.2, 1.84.0-dev.0.20260825144003-d5a41119e0e3 and more
- CVE-2026-57497webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown CapsulesGo · github.com/quic-go/webtransport-go · fixed in 0.11.1
- CVE-2026-47701OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer authGo · github.com/open-telemetry/opentelemetry-operator · fixed in 0.152.0
- CVE-2026-50018Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve ActionsGo · github.com/spectolabs/hoverfly · fixed in 1.12.8
- CVE-2026-50013Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff ModeGo · github.com/spectolabs/hoverfly · fixed in 1.12.8
- CVE-2026-48496opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agentGo · go.opentelemetry.io/ebpf-profiler · fixed in 0.0.202622
- CVE-2026-54174melange: Incomplete package integrity verification allows data section substitutionGo · chainguard.dev/apko, chainguard.dev/melange · fixed in 1.2.9, 0.50.4
- CVE-2026-54072Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URLGo · github.com/authorizerdev/authorizer · fixed in 0.0.0-20260409051328-bd3f5baf6d3d
- CVE-2026-89090Denial of service in the event stream header decoder in AWS SDK for Go v2Go · github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream, github.com/aws/aws-sdk-go-v2/service/bedrockagentcore +10 · fixed in 1.7.8, 1.15.2, 1.51.8 and more
- CVE-2026-49838GoBGP confederation validation panics on empty AS_PATH attributeGo · github.com/osrg/gobgp/v4 · fixed in 4.7.0
- CVE-2026-49837GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundariesGo · github.com/osrg/gobgp/v4 · fixed in 4.6.0
- CVE-2026-88046rclone: source object names can escape the configured root on uploadGo · github.com/rclone/rclone · fixed in 1.75.1
- CVE-2026-88045rclone: S3 multipart declared-length memory exhaustionGo · github.com/rclone/rclone · fixed in 1.75.1
- CVE-2026-88044rclone: RC per-server auth-proxy bypassGo · github.com/rclone/rclone · fixed in 1.75.1
- CVE-2026-88018rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypassGo · github.com/rclone/rclone · fixed in 1.75.1
- CVE-2026-88017rclone: FTP cross-session auth-proxy backend confusionGo · github.com/rclone/rclone · fixed in 1.75.1
- CVE-2026-88016rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destinationGo · github.com/rclone/rclone · fixed in 1.75.1
- CVE-2026-88015rclone local: crafted Range request against a translated symlink panics (DoS)Go · github.com/rclone/rclone · fixed in 1.75.1
- CVE-2026-88014rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespaceGo · github.com/rclone/rclone · fixed in 1.75.1