Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-62684File Browser: Share API exposes the password hash and bypass tokenGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.63.17
- CVE-2026-63328Trivy: Path Traversal in Trivy Plugin Manager Allows Arbitrary File WriteGo · github.com/aquasecurity/trivy · fixed in 0.72.0
- CVE-2026-50139goshs: Share-link ?token=… redemption races past download limitGo · goshs.de/goshs, goshs.de/goshs/v2 · fixed in 2.1.0
- CVE-2026-50138goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flagsGo · goshs.de/goshs, goshs.de/goshs/v2 · fixed in 2.1.0
- CVE-2026-74904SiYuan before v3.7.4 Missing Authorization via block APIGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260804015139-bd067a4fe9b2
- CVE-2026-64865New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypassGo · github.com/quantumnous/new-api · fixed in 1.0.0-rc.16
- CVE-2026-71479New API: Integer overflow in quota billing yields negative charges (self-crediting)Go · github.com/quantumnous/new-api · fixed in 1.0.0-rc.18
- CVE-2026-64866New API: Admin can reset passkeys for same-level or higher-privileged usersGo · github.com/quantumnous/new-api · fixed in 1.0.0-rc.7
- CVE-2026-64868New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body loggingGo · github.com/quantumnous/new-api · fixed in 1.0.0-rc.11
- CVE-2026-64859New API: User List API Leaks Root User Access Token Leading to Privilege EscalationGo · github.com/quantumnous/new-api · fixed in 1.0.0-rc.7
- CVE-2026-74802SiYuan 3.7.3 Cross-Site WebSocket Hijacking via network proxyGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260803045322-cb67e0b4fab5
- CVE-2026-74797OpenTofu before 1.11.4 Denial of Service via malicious zipGo · github.com/opentofu/opentofu · fixed in 1.11.4
- CVE-2026-74796OpenTofu before 1.11.7 Symlink Following Path TraversalGo · github.com/opentofu/opentofu · fixed in 1.11.7, 1.10.10
- CVE-2024-58375OpenTofu before 1.8.3 Secret Variable Leaking via Static EvaluationGo · github.com/opentofu/opentofu · fixed in 1.8.3
- CVE-2026-73054SiYuan before v3.7.4 Authentication Bypass via WebSocketGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260731131820-67bc300b6ea6
- CVE-2026-46603Excessive memory allocation during VP8L decoding in golang.org/x/imageGo · golang.org/x/image · fixed in 0.45.0
- CVE-2026-49826Concourse login flow has an open redirect issueGo · github.com/concourse/concourse · fixed in 1.6.1-0.20260526150512-ac60be5f0435
- CVE-2026-73630SiYuan before v3.7.4 Information Disclosure via authFilePublishAccessGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260731093152-c7522b8db586
- CVE-2026-73049SiYuan before v3.7.4 Information Disclosure via getAttributeViewBacklinksGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260730150429-5b42614311b0
- CVE-2026-72817go-chi chi 0.9.0 before 5.3.0 IP Spoofing via X-Forwarded-ForGo · github.com/go-chi/chi/middleware, github.com/go-chi/chi/v2/middleware +4 · fixed in 5.3.0
- CVE-2026-72816go-chi chi before 5.3.0 IP Spoofing via RealIP MiddlewareGo · github.com/go-chi/chi/middleware, github.com/go-chi/chi/v2/middleware +4 · fixed in 5.3.0
- CVE-2026-72815go-chi chi v5.2.1 IP Spoofing via X-Forwarded-For HeaderGo · github.com/go-chi/chi/v5, github.com/go-chi/chi/v5/middleware · fixed in 5.3.0
- CVE-2026-72812SiYuan before v3.7.4 Missing Authorization via refreshBacklinkGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260723002528-7d273c271ce1
- CVE-2026-72811SiYuan before v3.7.4 SQL Injection via backlink searchGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260723004839-1a5b3431d5ab
- CVE-2026-72810SiYuan before v3.7.4 Publish-Boundary Bypass via WebSocketGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260723013612-ba948639d7f6
- CVE-2025-71405go-chi chi before v5.2.2 Open Redirect via RedirectSlashesGo · github.com/go-chi/chi/v5 · fixed in 5.2.2
- CVE-2026-73843OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIsGo · github.com/openchoreo/openchoreo · fixed in 1.0.2, 1.1.2
- CVE-2026-73842OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutationGo · github.com/openchoreo/openchoreo · fixed in 1.0.3, 1.1.3, 1.2.0
- CVE-2026-56860Avoid quadratic complexity in resolvePath in net/urlGo · stdlib · fixed in 1.25.13, 1.26.6, 1.27.0-rc.3
- CVE-2026-56864Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdbGo · golang.org/x/mod, toolchain · fixed in 0.40.0, 1.25.13, 1.26.6 and more