Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-48754Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}Go · github.com/lxc/incus, github.com/lxc/incus/v6 +2 · fixed in 7.1.0
- CVE-2026-48753Incus has an arbitrary file write via path traversal in S3 multipart uploadGo · github.com/lxc/incus, github.com/lxc/incus/v6 +2 · fixed in 7.1.0
- CVE-2026-48752Incus has arbitrary file read+write on host via templates/ symlink in malicious imageGo · github.com/lxc/incus, github.com/lxc/incus/v6 +2 · fixed in 7.2.0
- CVE-2026-48751Incus has a restricted project bypass leading to arbitrary command executionGo · github.com/lxc/incus, github.com/lxc/incus/v6 +2 · fixed in 7.2.0
- CVE-2026-48750Incus has an arbitrary file write on host via `exec-output` symlink in crafted imageGo · github.com/lxc/incus, github.com/lxc/incus/v6 +2 · fixed in 7.2.0
- CVE-2026-48749Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious imageGo · github.com/lxc/incus, github.com/lxc/incus/v6 +2 · fixed in 7.2.0
- CVE-2026-47753Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted)Go · github.com/lxc/incus, github.com/lxc/incus/v6 +1 · fixed in 7.1.0
- CVE-2026-48756Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7)Go · github.com/lxc/incus, github.com/lxc/incus/v6 +2 · fixed in 7.1.0
- CVE-2026-77763JuiceFS Local Filestore Backend Joins Object Keys onto the Storage Root Without a Containment Check, Allowing Writes Outside the…Go · github.com/juicedata/juicefs
- CVE-2026-49244SFTPGo: Path confinement bypass in public browsable share partial ZIP downloadGo · github.com/drakkan/sftpgo, github.com/drakkan/sftpgo/v2 · fixed in 2.7.3
- CVE-2026-49245SFTPGo: Stored XSS via inline parameter on public shares and user file downloadGo · github.com/drakkan/sftpgo, github.com/drakkan/sftpgo/v2 · fixed in 2.7.3
- CVE-2026-50192Kerberos Hub private key (X-Kerberos-Hub-PrivateKey) leaked to cross-host redirect target due to redirect-following HTTP client without CheckRedirectGo · github.com/kerberos-io/agent/machinery · fixed in 0.0.0-20260528173546-51f1a52e170f
- CVE-2026-67448Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)Go · github.com/axllent/mailpit · fixed in 1.30.6
- CVE-2026-67447Mailpit: SMTP DATA line reader buffers over-limit input before size enforcementGo · github.com/axllent/mailpit · fixed in 1.30.5
- CVE-2026-67445Mailpit: SMTP command parser buffers unbounded command lines before syntax rejectionGo · github.com/axllent/mailpit · fixed in 1.30.4
- CVE-2026-67446Mailpit: Thumbnail generation decodes unbounded image dimensions before scalingGo · github.com/axllent/mailpit · fixed in 1.30.4
- CVE-2026-71485Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backendsGo · github.com/centrifugal/centrifugo, github.com/centrifugal/centrifugo/v3 +3 · fixed in 6.9.0
- CVE-2026-61625VictoriaMetrics vmrestore: path traversal via crafted backup part names escapes restore rootGo · github.com/victoriametrics/victoriametrics · fixed in 1.122.25, 1.136.12, 1.146.0
- CVE-2026-61711BuildKit: Custom frontend could bypass Seccomp/AppArmorGo · github.com/moby/buildkit · fixed in 0.31.1
- CVE-2026-61712BuildKit: Possible runtime DoS via unbounded group parsingGo · github.com/moby/buildkit · fixed in 0.31.1
- CVE-2026-52792Algernon: Server-side script source disclosure on Windows via NTFS filenameGo · github.com/xyproto/algernon · fixed in 1.17.9
- CVE-2026-44829Gotenberg: Path traversal in zip entry name via Windows-style separators in upload filenameGo · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8 · fixed in 8.33.0
- CVE-2026-45742Gotenberg: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')Go · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8 · fixed in 8.33.0
- CVE-2026-45741Gotenberg: SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixesGo · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8
- CVE-2026-50149Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate EnabledGo · github.com/projectcontour/contour · fixed in 1.33.5
- CVE-2026-76216Vikunja through 2.4.0 Principal-Type Confusion via LinkSharingGo · code.vikunja.io/api · fixed in 2.5.0
- CVE-2026-17106Tar extraction in moby/go-archive can write outside the destination directory via link followingGo · github.com/moby/go-archive · fixed in 0.3.0
- CVE-2026-65959Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL dataGo · vitess.io/vitess · fixed in 0.23.6, 0.24.3
- CVE-2026-69160OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation APIGo · github.com/openlistteam/openlist, github.com/openlistteam/openlist/v3 +1 · fixed in 4.2.4
- CVE-2026-73502kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schemaGo · github.com/getkin/kin-openapi · fixed in 0.144.0