Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-84303gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasionGo · google.golang.org/grpc · fixed in 1.83.1
- CVE-2026-84200Kyverno before v1.13.0 Policy Bypass via Multiple ExceptionsGo · github.com/kyverno/kyverno · fixed in 1.13.0
- CVE-2026-84199Kyverno before 1.16.2 SSRF via APICall FeatureGo · github.com/kyverno/kyverno · fixed in 1.16.2
- CVE-2026-84196Kyverno before 1.18.0 Server-Side Request Forgery via apiCallGo · github.com/kyverno/kyverno
- CVE-2026-84195Kyverno before 1.16.4 Credential Leak via apiCallGo · github.com/kyverno/kyverno · fixed in 1.17.0
- CVE-2025-15613Kyverno before v1.13.4 SSRF via Service CallGo · github.com/kyverno/kyverno
- CVE-2023-54356Kyverno before 1.9.5 Sweet32 Medium Strength Cipher SuitesGo · github.com/kyverno/kyverno · fixed in 1.9.5
- CVE-2026-53508oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)Go · github.com/oasdiff/oasdiff · fixed in 1.18.1
- CVE-2026-53553Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server CompromiseGo · github.com/zhenorzz/goploy · fixed in 1.18.0
- CVE-2026-53552Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlersGo · github.com/zhenorzz/goploy · fixed in 1.18.0
- CVE-2026-82651SiYuan before v3.8.1 Missing Authorization via /history and /repo/diffGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260816034002-035bf9a8c311
- CVE-2026-55785free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKAGo · github.com/free5gc/ausf · fixed in 1.4.5
- CVE-2026-55784free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPIGo · github.com/free5gc/ausf
- CVE-2026-55764Klever-Go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupplyGo · github.com/klever-io/klever-go · fixed in 1.7.19
- CVE-2026-55678Arc: Unauthenticated cluster node admission when `cluster.shared_secret` is unsetGo · github.com/basekick-labs/arc · fixed in 0.0.0-20260615160325-38402ad2ebdd
- CVE-2026-55763Klever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splitsGo · github.com/klever-io/klever-go · fixed in 1.7.19-rc4
- CVE-2026-55484ALOS HTTP: Unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire serverGo · github.com/guno1928/alos-http · fixed in 0.0.0-20260617230736-314b6783e196
- CVE-2026-55245Bifrost: SSRF deny-list incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURLGo · github.com/maximhq/bifrost/core · fixed in 1.5.17
- CVE-2026-55068free5GC: NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpointsGo · github.com/free5gc/free5gc · fixed in 4.2.2, 4.2.2+incompatible
- CVE-2026-55067Vikunja: Authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignmentGo · code.vikunja.io/api · fixed in 2.4.0
- CVE-2026-55066Vikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_idGo · code.vikunja.io/api · fixed in 2.4.0
- CVE-2026-55065Vikunja: Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/apiGo · code.vikunja.io/api · fixed in 2.4.0
- CVE-2026-55064Vikunja incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0Go · code.vikunja.io/api · fixed in 2.4.0
- CVE-2026-54766Vikunja: Project duplication bypasses write-permission check on the target parent projectGo · code.vikunja.io/api · fixed in 2.4.0
- CVE-2026-55834Pocket ID: Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=noneGo · github.com/pocket-id/pocket-id/backend · fixed in 2.9.0
- CVE-2026-55569aqua: Archive extraction in aqua follows attacker-planted symlinks, allowing writes outside the install directoryGo · github.com/aquaproj/aqua, github.com/aquaproj/aqua/v2 · fixed in 2.60.1
- CVE-2026-54755Klever-Go: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token)Go · github.com/klever-io/klever-go · fixed in 1.7.19
- CVE-2026-54754Klever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)Go · github.com/klever-io/klever-go · fixed in 1.7.19
- CVE-2026-55108KubeVela Terraform remote loader DoS via unbounded file readGo · github.com/oam-dev/kubevela · fixed in 1.9.14, 1.10.9, 1.11.0-alpha.4
- CVE-2026-54746Hatchet: Cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and UnsubscribeGo · github.com/hatchet-dev/hatchet · fixed in 0.91.2