Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-56854Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/sshGo · golang.org/x/crypto · fixed in 0.55.0
- CVE-2026-82234SiYuan before v3.8.1 SSRF via DNS-Rebinding TOCTOUGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260813142806-dd2778b70d02
- CVE-2026-82233SiYuan before v3.8.1 Path Traversal via asset.uploadGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260813142104-b26a4a307b8a
- CVE-2026-79921amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized PayloadGo · github.com/rabbitmq/amqp091-go · fixed in 1.13.0
- CVE-2026-60004Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.Go · code.gitea.io/gitea, gitea.dev · fixed in 1.27.1
- CVE-2026-54245Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet databaseGo · github.com/fleetdm/fleet, github.com/fleetdm/fleet/v4 · fixed in 4.86.2
- CVE-2026-46371Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpointGo · github.com/fleetdm/fleet/v4 · fixed in 4.84.2
- CVE-2026-46370Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpointGo · github.com/fleetdm/fleet/v4 · fixed in 4.84.2
- CVE-2026-41262Fleet: Cross-Team Policy Data Exposure via Global Policy Read EndpointGo · github.com/fleetdm/fleet/v4 · fixed in 4.85.0
- CVE-2026-48786Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpointGo · github.com/fleetdm/fleet/v4 · fixed in 4.87.0
- CVE-2026-54523Kyverno: NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any…Go · github.com/kyverno/kyverno · fixed in 1.18.2
- CVE-2026-32637Velero vulnerable to file path traversal when extracting from backup's tarballGo · github.com/vmware-tanzu/velero · fixed in 1.18.1
- CVE-2026-55588ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource ConsumptionGo · oras.land/oras · fixed in 1.3.3
- CVE-2026-55637genieacs-mcp: DNS rebinding reaches local GenieACS MCP Streamable HTTP transportGo · github.com/geiserx/genieacs-mcp · fixed in 0.3.2
- CVE-2026-55580mcp-shell — Security Disabled by Default in Bare-Binary Deploy Path + Shell Interpreter in Secure-Mode AllowlistGo · github.com/sonirico/mcp-shell · fixed in 0.6.0
- CVE-2026-55581mcp-shell: Secure Mode Allowlist Bypass via Default `/bin/bash` ExecutableGo · github.com/sonirico/mcp-shell · fixed in 0.6.0
- CVE-2026-55582mcp-shell: Secure Mode Allowlist Bypass via Git Shell AliasGo · github.com/sonirico/mcp-shell · fixed in 0.6.0
- CVE-2026-79783rclone before 1.74.4 Privilege Escalation via setuid MetadataGo · github.com/rclone/rclone · fixed in 1.74.4
- CVE-2026-79782rclone before 1.74.4 Security Token Disclosure via HTTPS to HTTP RedirectGo · github.com/rclone/rclone · fixed in 1.74.4
- CVE-2026-79781rclone serve s3 Path Traversal via dot-dot object keysGo · github.com/rclone/rclone · fixed in 1.74.4
- CVE-2026-79780rclone before v1.75.0 Credential Exposure via S3 RedirectGo · github.com/rclone/rclone · fixed in 1.75.0
- CVE-2026-79779rclone before v1.75.0 WebDAV Credential Exposure via HTTPS-to-HTTP RedirectGo · github.com/rclone/rclone · fixed in 1.75.0
- CVE-2026-79778rclone before v1.75.0 Denial of Service via TUS nil-response panicGo · github.com/rclone/rclone · fixed in 1.75.0
- CVE-2026-79777rclone before v1.75.0 Information Disclosure via RC APIGo · github.com/rclone/rclone · fixed in 1.75.0
- CVE-2026-79673Ech0 before 4.4.3 Scope Bypass via profile:read TokenGo · github.com/lin-snow/ech0 · fixed in 4.4.3
- CVE-2026-79672Ech0 before 4.4.3 Authentication Bypass via Comment PanelGo · github.com/lin-snow/ech0 · fixed in 4.4.3
- CVE-2026-79671Ech0 before 4.4.3 SSRF via DNS Resolution BypassGo · github.com/lin-snow/ech0 · fixed in 4.4.3
- CVE-2026-79670Ech0 before 4.4.3 Stored XSS via SVG UploadGo · github.com/lin-snow/ech0 · fixed in 4.4.3
- CVE-2026-79669Ech0 before 4.4.3 Missing Authorization on System LogsGo · github.com/lin-snow/ech0 · fixed in 4.4.3
- CVE-2026-79668Ech0 before 4.7.3 Unauthenticated Like Endpoint Metric InflationGo · github.com/lin-snow/ech0 · fixed in 1.4.8-0.20260503040728-a7e8b8e84bd1