Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-88013rclone: http backend forwards custom/auth headers to a different host on redirectGo · github.com/rclone/rclone · fixed in 1.75.1
- CVE-2026-88012Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unboundedGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.56, 3.7.12
- CVE-2026-88011Traefik: ForwardAuth identity spoofing via dot-form header aliasGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.56, 3.7.12
- CVE-2026-88009Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access loggingGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.57, 3.7.13
- CVE-2026-88008Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect AuthorizationGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.57, 3.7.13
- CVE-2026-88007Traefik HTTP/3 Backend NTLM Connection ReuseGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.57, 3.7.13
- CVE-2026-88004Traefik entrypoint header-name sanitization bypassed via request trailersGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 3.7.13
- CVE-2026-88879Traefik before v2.11.56 Identity Spoofing via Header AliasGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.56, 3.7.12
- CVE-2026-88878Traefik v2.8.2 through v3.6 HTTP/3 Timeout BypassGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.56, 3.7.12
- CVE-2026-47680Source controller: Improper path handling allows traversalGo · github.com/fluxcd/source-controller · fixed in 1.8.5
- CVE-2026-86597Sensitive information written to logs by Snowflake driversGo · github.com/snowflakedb/gosnowflake, github.com/snowflakedb/gosnowflake/v2 · fixed in 2.2.0
- CVE-2026-63464Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`Go · github.com/forgekeep/nebula-mesh · fixed in 0.7.2
- CVE-2026-61699nebula-mesh: Certificate revocation is never enforced at the meshGo · github.com/forgekeep/nebula-mesh · fixed in 0.7.1
- CVE-2026-55513nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokensGo · github.com/forgekeep/nebula-mesh, github.com/juev/nebula-mesh · fixed in 0.5.0
- CVE-2026-55512nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limitingGo · github.com/forgekeep/nebula-mesh, github.com/juev/nebula-mesh · fixed in 0.5.0
- CVE-2026-53604nebula-mesh: CA private key not zeroized on web mobile-bundle error pathsGo · github.com/forgekeep/nebula-mesh · fixed in 0.3.8
- CVE-2026-53603nebula-mesh: Operator session tokens stored in plaintext in the databaseGo · github.com/forgekeep/nebula-mesh · fixed in 0.3.8
- CVE-2026-53602nebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificateGo · github.com/forgekeep/nebula-mesh · fixed in 0.3.7
- CVE-2026-50553Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)Go · github.com/enchant97/note-mark/backend · fixed in 0.0.0-20260601210719-67b7de04308a
- CVE-2026-75602OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download toolGo · github.com/openlistteam/openlist, github.com/openlistteam/openlist/v3 +1 · fixed in 4.2.3
- CVE-2026-50554Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-markGo · github.com/enchant97/note-mark/backend · fixed in 0.0.0-20260601210758-9c9b72740f22
- CVE-2026-85175SiYuan before v3.8.2 TLS Private Key Disclosure via getFileGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260819144130-256d73aa7f94
- CVE-2026-56855Prevent DoS on deadlocked established channel in golang.org/x/crypto/sshGo · golang.org/x/crypto · fixed in 0.56.0
- CVE-2026-78662Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/sshGo · golang.org/x/crypto · fixed in 0.56.0
- CVE-2026-53649Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCEGo · github.com/bishopfox/joro · fixed in 0.0.0-20260601151442-5c0ca35db828
- CVE-2026-52831Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCEGo · github.com/nuclio/nuclio · fixed in 0.0.0-20260601075854-3356b86a8bfa
- CVE-2026-52833Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCEGo · github.com/nuclio/nuclio · fixed in 1.16.5
- CVE-2026-52832Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard containerGo · github.com/nuclio/nuclio · fixed in 1.16.5
- CVE-2026-45730Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any projectGo · github.com/nuclio/nuclio · fixed in 0.0.0-20260513101907-1915cd26d514
- CVE-2026-84304gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame FragmentationGo · google.golang.org/grpc · fixed in 1.83.1