Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-18679Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configuredGo · github.com/kumahq/kuma, github.com/kumahq/kuma/v2 · fixed in 2.7.26, 2.9.16, 2.11.14 and more
- CVE-2026-18678Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configuredGo · github.com/kumahq/kuma, github.com/kumahq/kuma/v2 · fixed in 2.7.26, 2.11.14, 2.12.11 and more
- CVE-2026-18676Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost adminGo · github.com/kumahq/kuma, github.com/kumahq/kuma/v2 · fixed in 2.7.25, 2.9.15, 2.11.13 and more
- CVE-2026-73294Semaphore U: OS Command InjectionGo · github.com/semaphoreui/semaphore · fixed in 0.0.0-20260704181911-7e8a9434bd81
- CVE-2026-73293Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collisionGo · github.com/semaphoreui/semaphore · fixed in 0.0.0-20260705182501-bb2a4e1f08c8
- CVE-2026-73292Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmationGo · github.com/semaphoreui/semaphore · fixed in 0.0.0-20260707190631-c59c3dc9035b
- CVE-2026-49349regclient may leak authentication credentials to external blob storesGo · github.com/regclient/regclient · fixed in 0.11.5
- CVE-2026-73232ffuf denial of service (OOM) via HTTP response decompression bombGo · github.com/ffuf/ffuf, github.com/ffuf/ffuf/v2 · fixed in 2.2.0
- CVE-2026-48790turso-cli persists Turso platform JWT with world-readable (0o644) file permissionsGo · github.com/tursodatabase/turso-cli · fixed in 1.0.26
- CVE-2026-73087Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcherGo · github.com/amir20/dozzle · fixed in 1.29.1-0.20260804193351-8cf7ccd5ee04
- CVE-2026-73080SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedleGo · github.com/seaweedfs/seaweedfs · fixed in 0.0.0-20260512171120-69da20bdaec9
- CVE-2026-72921SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling pathsGo · github.com/seaweedfs/seaweedfs · fixed in 0.0.0-20260512171048-05ed5c9ae8a2
- CVE-2026-72920SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative controlGo · github.com/seaweedfs/seaweedfs · fixed in 0.0.0-20260512171108-5e8f99f40a8a
- CVE-2026-52880Klever-Go: REST API slow-header connection exhaustion via Gin Engine.RunGo · github.com/klever-io/klever-go · fixed in 1.7.18
- CVE-2026-52879Klever-Go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoSGo · github.com/klever-io/klever-go · fixed in 1.7.18
- CVE-2026-52878Klever-Go: Unauthenticated nil-pointer DoS in P2P transaction validation can halt the chainGo · github.com/klever-io/klever-go · fixed in 1.7.18
- CVE-2026-49343Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoSGo · github.com/klever-io/klever-go · fixed in 1.7.18
- CVE-2026-47249Klever-Go KVM: Hash-array amplification in P2P resolver request handlingGo · github.com/klever-io/klever-go · fixed in 1.7.18
- CVE-2026-47243Kata guest escape: runtime-rs guest-root to host-root escape via virtiofsGo · github.com/kata-containers/kata-containers · fixed in 0.0.0-20260519062212-ffa59ce3aa78
- CVE-2026-45808OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACLGo · github.com/openbao/openbao · fixed in 2.5.4
- CVE-2026-46405OpenBao's Kerberos Auth Method Accumulates Unaccessible TokensGo · github.com/openbao/openbao · fixed in 2.5.4
- CVE-2026-46358OpenBao's Inline Auth Incorrectly Redacted HeadersGo · github.com/openbao/openbao · fixed in 2.5.4
- CVE-2026-71557go-git: Malicious reference names may modify files outside the reference storageGo · github.com/go-git/go-git/v5, github.com/go-git/go-git/v6 · fixed in 5.19.2, 6.0.0-alpha.5
- CVE-2026-71556go-git: Worktree operations may follow symlinksGo · github.com/go-git/go-git/v5, github.com/go-git/go-git/v6 · fixed in 5.19.2, 6.0.0-alpha.5
- CVE-2026-64655GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN MatchingGo · github.com/cli/cli, github.com/cli/cli/v2 · fixed in 2.97.0
- CVE-2026-64653GitHub CLI: Unescaped variable components in request URLs could allow path traversalGo · github.com/cli/cli, github.com/cli/cli/v2 · fixed in 2.97.0
- CVE-2026-64652GitHub CLI: Partial token disclosure in `gh auth status` outputGo · github.com/cli/cli, github.com/cli/cli/v2 · fixed in 2.97.0
- CVE-2026-71327Traefik: Gateway API route identity collision allows cross-namespace backend hijackingGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 3.6.25, 3.7.10
- CVE-2026-71326Traefik: BasicAuth singleflight key collision allows authenticated identity spoofingGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 3.6.25, 3.7.10
- CVE-2026-71325Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRefGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.54, 3.6.25, 3.7.10