Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-56865Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlogGo · golang.org/x/mod, toolchain · fixed in 0.40.0, 1.25.13, 1.26.6 and more
- CVE-2026-56858Fix Javascript regexp context tracking in html/templateGo · stdlib · fixed in 1.25.13, 1.26.6, 1.27.0-rc.3
- CVE-2026-56862Limit handshake messages we are willing to accept post-handshake in crypto/tlsGo · stdlib · fixed in 1.25.13, 1.26.6, 1.27.0-rc.3
- CVE-2026-56853Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/httpGo · stdlib · fixed in 1.25.13, 1.26.6, 1.27.0-rc.3
- CVE-2026-56859Add recursion depth guard during decode in encoding/xmlGo · stdlib · fixed in 1.25.13, 1.26.6, 1.27.0-rc.3
- CVE-2026-33818Enforce maximum recursion depth in encoding/asn1Go · encoding/asn1 · fixed in 1.25.13, 1.26.6, 1.27.0-rc.3
- CVE-2026-73841OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpointsGo · github.com/openchoreo/openchoreo · fixed in 1.2.3, 1.1.6
- CVE-2026-73840OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)Go · github.com/openchoreo/openchoreo · fixed in 1.0.3, 1.1.3, 1.2.0-rc.2
- CVE-2026-73667OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged podsGo · github.com/openchoreo/openchoreo · fixed in 1.0.4, 1.1.4, 1.2.0-rc.2
- CVE-2026-19730Podman: podman: quadlet install --replace non-truncating write retains removed host-access directivesGo · github.com/containers/podman, github.com/containers/podman/v2 +3 · fixed in 5.8.6
- CVE-2026-73564frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer OverflowGo · github.com/fatedier/frp · fixed in 0.70.1
- CVE-2026-24791Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routesGo · code.gitea.io/gitea · fixed in 1.26.2
- CVE-2026-59765SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud MetadataGo · code.gitea.io/gitea, gitea.dev · fixed in 1.27.0
- CVE-2026-59763Unbounded Arch package file metadata can cause resource amplification in Gitea package uploadsGo · code.gitea.io/gitea, gitea.dev · fixed in 1.27.0
- CVE-2026-58511Webhook Authorization Header Returned in Plaintext via APIGo · code.gitea.io/gitea, gitea.dev · fixed in 1.27.0
- CVE-2026-58510GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->privateGo · code.gitea.io/gitea, gitea.dev · fixed in 1.27.0
- CVE-2026-58507Private Repository Existence Disclosure via go-get Meta EndpointGo · code.gitea.io/gitea, gitea.dev · fixed in 1.27.0
- CVE-2026-58445Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel APIGo · code.gitea.io/gitea, gitea.dev · fixed in 1.27.0
- CVE-2026-58444Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contentsGo · code.gitea.io/gitea, gitea.dev · fixed in 1.27.0
- CVE-2026-58443Public-only repository tokens can update private PR head branchesGo · code.gitea.io/gitea, gitea.dev · fixed in 1.27.0
- CVE-2026-58442Repository migration SSRF via multi-answer DNS allow-list bypassGo · code.gitea.io/gitea, gitea.dev · fixed in 1.27.0
- CVE-2026-58441SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURLGo · code.gitea.io/gitea, gitea.dev · fixed in 1.27.0
- CVE-2026-58440Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)Go · gitea.dev · fixed in 1.27.0
- CVE-2026-58439Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval FlagGo · code.gitea.io/gitea · fixed in 1.27.0
- CVE-2026-58438Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot accessGo · gitea.dev · fixed in 1.27.0
- CVE-2026-58437Repository Visibility Manipulation via Git Push OptionsGo · code.gitea.io/gitea, gitea.dev · fixed in 1.27.0
- CVE-2026-58436ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requestsGo · code.gitea.io/gitea, gitea.dev · fixed in 1.27.0
- CVE-2026-58435Gitea LFS Deploy-Key Privilege EscalationGo · code.gitea.io/gitea, gitea.dev · fixed in 1.27.0
- CVE-2026-58434Private Repository Metadata Remains Accessible After Access RevocationGo · code.gitea.io/gitea, gitea.dev · fixed in 1.27.0
- CVE-2026-58432Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/giteaGo · code.gitea.io/gitea, gitea.dev · fixed in 1.27.0