Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-71324Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive poolGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.53, 3.6.24, 3.7.9
- CVE-2026-71313rclone: Local Encoding Path TraversalGo · github.com/rclone/rclone · fixed in 1.75.0
- CVE-2026-71312rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command ExecutionGo · github.com/rclone/rclone · fixed in 1.75.0
- CVE-2026-71311rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves NewlinesGo · github.com/rclone/rclone · fixed in 1.75.0
- CVE-2026-34966Gitea prior to 1.27.0 SSRF via Migration URI Fetch BypassGo · code.gitea.io/gitea, gitea.dev · fixed in 1.27.0
- CVE-2026-71310rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone MemoryGo · github.com/rclone/rclone · fixed in 1.75.0
- CVE-2026-71309rclone: Incomplete path validation allows backend root escape in serve resticGo · github.com/rclone/rclone · fixed in 1.75.0
- CVE-2026-48154GoRest: InMemorySecret2FA race condition allows process crash via concurrent map accessGo · github.com/pilinux/gorest · fixed in 1.12.2
- CVE-2026-48113Chisel: ACL Bypass via Post-Handshake SSH Channel ExtraData InjectionGo · github.com/jpillora/chisel · fixed in 1.11.5
- CVE-2026-48031Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token ForgeryGo · github.com/dhax/go-base · fixed in 0.0.0-20260517152733-cc82b9740fa6
- CVE-2026-69086SiYuan before v3.7.3 Path Traversal via unvalidated avIDGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260720151813-0f5a0e7c67b0
- CVE-2026-69085SiYuan before v3.7.3 SQL Injection via searchDocsGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260721043339-eef10568384e
- CVE-2026-69084SiYuan before v3.7.3 SQL Injection via searchEmbedBlockGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260721002947-23a17d44b5f3
- CVE-2026-69083SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContentGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260721004815-cf42dd5680c8
- CVE-2026-68587SiYuan before v3.7.3 Information Disclosure via getHeading*TransactionGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260721013353-69db783b782a
- CVE-2026-68586SiYuan before v3.7.3 Content Disclosure via getBacklinkDocGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260721014413-f45749a7ef6e
- CVE-2026-68585SiYuan before v3.7.3 Metadata Disclosure via getBlockInfoGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260721014951-ffde3b21eca4
- CVE-2026-68584SiYuan before v3.7.3 Authentication Bypass via Content EndpointsGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260721020826-2d069dce84a2
- CVE-2026-68582Vikunja 0.24.0 Broken Object Level Authorization via Link-Share TokenGo · code.vikunja.io/api · fixed in 2.4.0
- CVE-2026-68581Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID CollisionGo · code.vikunja.io/api · fixed in 2.4.0
- CVE-2026-67309Traefik v3.7.0 Path Traversal via RewriteTarget Authentication BypassGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 3.7.8
- CVE-2026-54909Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attributeGo · github.com/pion/stun, github.com/pion/stun/v2 +1 · fixed in 3.1.5
- CVE-2026-54787sigstore-go fails to check signature timestamps against a signing key's validity periodGo · github.com/sigstore/sigstore-go · fixed in 1.2.1
- CVE-2026-53551free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failureGo · github.com/free5gc/ausf, github.com/free5gc/free5gc · fixed in 1.4.5, 4.2.2, 4.2.2+incompatible
- CVE-2026-54725vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest APIGo · github.com/bank-vaults/vault-secrets-webhook · fixed in 1.23.1
- CVE-2026-52856Wings: Maliciously crafted packet during SFTP connection handshake causes denial of serviceGo · github.com/pterodactyl/wings · fixed in 1.13.0
- CVE-2026-52855Wings exposes node configuration secrets through egg configuration-file templatingGo · github.com/pterodactyl/wings · fixed in 1.12.3
- CVE-2026-52857Wings: Maliciously or erroneously created parsed config files can cause wings process to OOMGo · github.com/pterodactyl/wings · fixed in 1.13.0
- CVE-2026-62323Cloudreve: Unauthorized file write via WOPI view sessions whose access token secret is ignoredGo · github.com/cloudreve/cloudreve, github.com/cloudreve/cloudreve/v3 +1 · fixed in 4.0.0-20260626022433-f3347130ac48
- CVE-2026-55502Cloudreve: OAuth Admin.Read scope can update OneDrive storage policy credentialsGo · github.com/cloudreve/cloudreve, github.com/cloudreve/cloudreve/v3 +1 · fixed in 4.17.0