Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-88982Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook…Go · github.com/kubeflow/pipelines · fixed in 0.0.0-20260910172610-620d0cc89ae0
- CVE-2026-77596Kubeflow Pipelines API server lacks authorization for shared pipeline uploadsGo · github.com/kubeflow/pipelines · fixed in 0.0.0-20260909234119-62516d8c525f
- CVE-2026-88984Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelinesGo · github.com/kubeflow/pipelines · fixed in 0.0.0-20260420170029-186dd1f3b040
- CVE-2026-88986Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error responsesGo · github.com/kubeflow/pipelines · fixed in 0.0.0-20251010122814-fedc25e3f725
- CVE-2026-88985Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API serverGo · github.com/kubeflow/pipelines · fixed in 0.0.0-20260403210607-ac3a4c65677a
- CVE-2026-88983Kubeflow Pipelines — API server fetches a caller-supplied pipelineURL without host validationGo · github.com/kubeflow/pipelines · fixed in 0.0.0-20260517162502-504d7797c1e0
- CVE-2026-77463Remark42: Rate limit bypass via unconditional trust of X-Forwarded-For/X-Real-IP headers in direct-internet deploymentGo · github.com/umputun/remark42, github.com/umputun/remark42/backend · fixed in 1.16.2
- CVE-2026-77622Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG DecoderGo · github.com/bishopfox/sliver · fixed in 1.7.6
- CVE-2026-34157Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOriginsGo · github.com/wailsapp/wails/v2 · fixed in 2.13.0
- CVE-2026-55458Caddy: RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak throughGo · github.com/caddyserver/caddy/v2 · fixed in 2.11.5
- CVE-2026-123012In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a…Go · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-115770Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofingGo · github.com/pocket-id/pocket-id/backend · fixed in 0.0.0-20260727180059-43aaccd5bfac
- CVE-2026-62662Pocket ID: Client credentials grant allows any OIDC client to obtain tokens for arbitrary audiencesGo · github.com/pocket-id/pocket-id/backend · fixed in 0.0.0-20260622164202-8158452b3730
- CVE-2026-86041ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` headerGo · github.com/mayswind/ezbookkeeping · fixed in 1.6.0
- CVE-2026-102340Telepresence: Traffic Manager gRPC has no auth — any pod claims arbitrary namespace and intercepts services, receiving victim environment…Go · github.com/telepresenceio/telepresence · fixed in 2.31.0
- CVE-2026-122132go-chi chi 5.2.2 through 5.5.0 Open Redirect via RedirectSlashes MiddlewareGo · github.com/go-chi/chi, github.com/go-chi/chi/v2 +3 · fixed in 5.2.4
- CVE-2026-102339Telepresence: Tunnel endpoint accepts caller-supplied session ID with no ownership proof — active client sessions hijackableGo · github.com/telepresenceio/telepresence/v2 · fixed in 2.31.0
- CVE-2026-114456Missing origin validation for the externalbrowser authenticator callback in multiple Snowflake client driversGo · github.com/snowflakedb/gosnowflake, github.com/snowflakedb/gosnowflake/v2 · fixed in 2.3.0
- CVE-2026-64672Terragrunt catalog predictable temp symlink clobberGo · github.com/gruntwork-io/terragrunt · fixed in 1.1.1
- CVE-2026-63198traQ: Privilege escalation by OAuth prompt=none requestGo · github.com/traptitech/traq · fixed in 1.0.0-rc.2.0.20260629134940-5510fe8aa9bb
- CVE-2026-63197traQ: XSS in the User Uploaded File Retrieval APIGo · github.com/traptitech/traq · fixed in 1.0.0-rc.2.0.20260627142846-3db29e777166
- GHSA-9PPR-WFW9-XVR2Netfoil doesn't decrement TTLGo · github.com/tinfoil-factory/netfoil · fixed in 0.6.1
- GHSA-M3QR-FVP4-78XJArc has unauthenticated application log disclosure via `/api/v1/logs`Go · github.com/basekick-labs/arc · fixed in 0.0.0-20260615165136-bb7d9761ad98
- CVE-2026-105770Octo STS discloses trust policy contents to unauthorized callers via Exchange error messagesGo · github.com/octo-sts/app · fixed in 0.11.2
- CVE-2026-120091Temporal Server Kubernetes compute provider builds a client from caller-supplied configuration and runs a caller-chosen command on the…Go · go.temporal.io/server · fixed in 1.31.5, 1.32.2
- CVE-2026-105769kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hostsGo · github.com/chainguard-dev/kaniko · fixed in 1.25.20
- GHSA-2WRX-84QJ-4PCGanacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoSGo · github.com/anacrolix/torrent · fixed in 1.61.1-0.20260911233437-76452a2c8a2f
- CVE-2026-55098Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735Go · github.com/basekick-labs/arc · fixed in 0.0.0-20260610131716-5dc8f53b70a3
- CVE-2026-62284OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxyGo · github.com/osac-project/osac-operator · fixed in 0.0.4
- CVE-2026-62331praktor: Telegram upload traversal permits persistent agent instruction injectionGo · github.com/mtzanidakis/praktor · fixed in 0.9.1