Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-79667Ech0 before 4.4.3 Authentication Bypass via Scope EnforcementGo · github.com/lin-snow/ech0 · fixed in 4.3.5
- CVE-2026-79666Ech0 before 4.4.3 Missing Authorization via dashboard log endpointsGo · github.com/lin-snow/ech0 · fixed in 4.3.5
- CVE-2026-79664Ech0 before 4.7.3 Access Token Revocation BypassGo · github.com/lin-snow/ech0 · fixed in 1.4.8-0.20260503041146-eab62379c795
- CVE-2026-79663Ech0 before 4.7.3 Stored XSS via RSS feed tag namesGo · github.com/lin-snow/ech0 · fixed in 1.4.8-0.20260503035519-fd320fe3e902
- CVE-2026-79662Ech0 before 4.7.3 OAuth Redirect URI Validation BypassGo · github.com/lin-snow/ech0 · fixed in 1.4.8-0.20260503040728-a7e8b8e84bd1
- CVE-2026-79661Ech0 before 4.7.3 Unauthenticated fav_count ModificationGo · github.com/lin-snow/ech0 · fixed in 1.4.8-0.20260503035905-cecc2c19b590
- CVE-2026-79660Ech0 before 4.7.3 Email Disclosure via Public APIGo · github.com/lin-snow/ech0 · fixed in 1.4.8-0.20260503034700-cb8d7a997dd8
- CVE-2026-79659Ech0 before 4.7.3 Server-Side Request Forgery via fetchPeerConnectInfoGo · github.com/lin-snow/ech0 · fixed in 1.4.8-0.20260503040602-091d26d2d942
- CVE-2026-45404OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent accessGo · go.opentelemetry.io/otel/bridge/opentracing · fixed in 1.45.0
- CVE-2026-76835OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy SetGo · github.com/oauth2-proxy/oauth2-proxy, github.com/oauth2-proxy/oauth2-proxy/v7 · fixed in 7.15.2
- CVE-2026-62204SiYuan before v3.7.4 Plugin Overwrite via Bazaar InstallGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260808010544-26ccb40d390e
- CVE-2026-60083SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file toolGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260808051406-3542530c505f
- CVE-2026-53541OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input FilteringGo · github.com/olivetin/olivetin · fixed in 0.0.0-20260531214440-ebffd9f040f7
- CVE-2026-47735Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checksGo · github.com/basekick-labs/arc · fixed in 0.0.0-20260520141557-91bdc29d1a02
- CVE-2026-48050Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoSGo · github.com/basekick-labs/arc · fixed in 0.0.0-20260520170331-32a4091fb949
- CVE-2026-53487Kite has an authenticated cluster RBAC bypass in /api/v1/overviewGo · github.com/zxh326/kite · fixed in 0.12.3
- CVE-2026-77354kin-openapi: Uncontrolled resource consumption in openapi3filter deepObject query parameter decodingGo · github.com/getkin/kin-openapi · fixed in 0.142.0
- CVE-2026-76905kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoSGo · github.com/getkin/kin-openapi · fixed in 0.141.0
- CVE-2026-64679Atlantis: Path Traversal in Atlantis Workspace Handling Allows Out-of-Bounds Directory Deletion/CreationGo · github.com/runatlantis/atlantis · fixed in 0.45.0
- CVE-2026-44517Buildah: Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archiveGo · github.com/containers/buildah · fixed in 1.43.2
- CVE-2026-62283Nezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership checkGo · github.com/nezhahq/nezha · fixed in 2.0.10
- CVE-2026-55185Miniflux 2: Open Redirect BypassGo · miniflux.app, miniflux.app/v2 · fixed in 2.3.1
- CVE-2026-53572KEDA: PostgreSQL connection string parameter injection via incomplete whitespace escapingGo · github.com/kedacore/keda, github.com/kedacore/keda/v2 · fixed in 2.20.0
- CVE-2026-45099Terragrunt: Arbitrary File Deletion via Malicious Module ManifestGo · github.com/gruntwork-io/terragrunt · fixed in 1.0.4
- CVE-2026-71493Infracost: Arbitrary file read via config-template readFile symlink traversalGo · github.com/infracost/infracost · fixed in 0.10.45
- CVE-2026-71494Infracost: Terraform Cloud and registry token disclosure via unvalidated hostnameGo · github.com/infracost/infracost · fixed in 0.10.45
- CVE-2026-55622Incus has a project restriction bypass in instance copy across projectsGo · github.com/lxc/incus, github.com/lxc/incus/v6 +2 · fixed in 7.2.0
- CVE-2026-55621Incus has a project restriction bypass for custom volume copy across projectsGo · github.com/lxc/incus, github.com/lxc/incus/v6 +1 · fixed in 7.2.0
- CVE-2026-48769Incus has an arbitrary file write on its client due to trusted image hashGo · github.com/lxc/incus, github.com/lxc/incus/v6 +2 · fixed in 7.2.0
- CVE-2026-48755Incus has an argument injection in backup compression algorithm leading to AFW and ACEGo · github.com/lxc/incus, github.com/lxc/incus/v6 +2 · fixed in 7.2.0