Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-58431Public-only API token restriction is not enforced on team API routesGo · gitea.dev · fixed in 1.27.0
- CVE-2026-58429Public-Only Personal access tokens scope bypass in Organization and Permission EndpointsGo · code.gitea.io/gitea, gitea.dev · fixed in 1.27.0
- CVE-2026-58428Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)Go · code.gitea.io/gitea, gitea.dev · fixed in 1.27.0
- CVE-2026-58427Private org member list leaked via /members API endpoint — incomplete fix for PR #38145Go · gitea.dev · fixed in 1.27.0
- CVE-2026-58425OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)Go · code.gitea.io/gitea, gitea.dev · fixed in 1.27.0
- CVE-2026-58420Local File Inclusion via file:// URI in Migration RestoreGo · gitea.dev · fixed in 1.27.0
- CVE-2026-58417REST API exposes organization membership of private organizations to publicGo · gitea.dev · fixed in 1.27.0
- CVE-2026-58416Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)Go · gitea.dev · fixed in 1.27.0
- CVE-2026-58314Two SSRF findings in Gitea 1.26.2Go · code.gitea.io/gitea, gitea.dev · fixed in 1.27.0
- CVE-2026-57897Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIsGo · code.gitea.io/gitea, gitea.dev · fixed in 1.27.0
- CVE-2026-57894Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository ExfiltrationGo · code.gitea.io/gitea, gitea.dev · fixed in 1.27.0
- CVE-2026-57886Cross-repository issue/comment attachment re-linking can expose private attachment contentGo · code.gitea.io/gitea, gitea.dev · fixed in 1.27.0
- CVE-2026-56755Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package UploadGo · code.gitea.io/gitea, gitea.dev · fixed in 1.27.0
- CVE-2026-56750Gitea Remember-Me Token Theft Not Invalidating Attacker SessionGo · code.gitea.io/gitea, gitea.dev · fixed in 1.27.0
- CVE-2026-56657Gitea SSH Key Parser Denial of ServiceGo · code.gitea.io/gitea, gitea.dev · fixed in 1.27.0
- CVE-2026-56654Privilege Escalation via Access Token Scope Escalation in APIGo · code.gitea.io/gitea, gitea.dev · fixed in 1.27.0
- CVE-2026-56443Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118Go · code.gitea.io/gitea, gitea.dev · fixed in 1.27.0
- CVE-2026-55987OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)Go · code.gitea.io/gitea, gitea.dev · fixed in 1.27.0
- CVE-2026-55984Null Pointer Dereference in AddTime API Causes Authenticated Denial of ServiceGo · code.gitea.io/gitea, gitea.dev · fixed in 1.27.0
- CVE-2026-55982OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token ScopesGo · code.gitea.io/gitea, gitea.dev · fixed in 1.27.0
- CVE-2026-54481Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)Go · code.gitea.io/gitea, gitea.dev · fixed in 1.27.0
- CVE-2026-50105RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)Go · code.gitea.io/gitea, gitea.dev · fixed in 1.27.0
- CVE-2026-42931Denial of Service via Unbounded io.ReadAll in NPM Package Tag EndpointGo · code.gitea.io/gitea, gitea.dev · fixed in 1.27.0
- CVE-2026-23603Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claimGo · code.gitea.io/gitea, gitea.dev · fixed in 1.27.0
- CVE-2026-49820Probo has an open redirect bypass via path normalizationGo · go.probo.inc/probo · fixed in 0.204.0
- CVE-2026-73509OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversalGo · github.com/openlistteam/openlist, github.com/openlistteam/openlist/v3 +1 · fixed in 4.2.4
- CVE-2026-73506Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment dataGo · github.com/jandedobbeleer/oh-my-posh · fixed in 29.35.1+incompatible, 29.35.1
- CVE-2026-73505Oh My Posh: Arbitrary command execution via template injection in the path segmentGo · github.com/jandedobbeleer/oh-my-posh · fixed in 29.35.1, 29.35.1+incompatible
- CVE-2026-48702Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing LogicGo · github.com/sigstore/rekor · fixed in 1.5.2
- CVE-2026-49478Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token LeakageGo · github.com/sigstore/fulcio · fixed in 1.8.6