Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-55499Cloudreve: Broken access control in file event stream leaks activity events for unshared siblings to single-file share recipientsGo · github.com/cloudreve/cloudreve, github.com/cloudreve/cloudreve/v3 +1 · fixed in 4.0.0-20260613030215-0b00dd308f13
- CVE-2026-55497Cloudreve: Server crash through image decompression/pixel bomb in thumbnail & avatar decoding (DoS)Go · github.com/cloudreve/cloudreve, github.com/cloudreve/cloudreve/v3 +1 · fixed in 4.0.0-20260613024411-3607f79bb44c
- CVE-2026-55496Cloudreve: Inactive/banned account emails leaked via GET /api/v4/user/search because SearchActive() omits the active-status predicateGo · github.com/cloudreve/cloudreve, github.com/cloudreve/cloudreve/v3 +1 · fixed in 4.0.0-20260613023921-7e1289d55279
- CVE-2026-55495Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner AccountGo · github.com/cloudreve/cloudreve, github.com/cloudreve/cloudreve/v3 +1 · fixed in 4.0.0-20260613023150-7968e50429ef
- CVE-2026-65835Capsule: Incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation)Go · github.com/projectcapsule/capsule · fixed in 0.13.8
- CVE-2026-65834Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requestsGo · github.com/projectcapsule/capsule · fixed in 0.13.8
- CVE-2026-67439OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action OutputGo · github.com/olivetin/olivetin · fixed in 0.0.0-20260708085316-e421780c9885
- CVE-2026-67438OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety CheckGo · github.com/olivetin/olivetin · fixed in 0.0.0-20260708084548-995ff79736f2
- CVE-2026-67437OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)Go · github.com/olivetin/olivetin · fixed in 0.0.0-20260708075951-ec114e95d297
- CVE-2026-54680Logging operator has Fluentd configuration injection that allows remote code executionGo · github.com/kube-logging/logging-operator · fixed in 0.0.0-20260608145523-cf437d7f1e05
- CVE-2026-54693ZITADEL Users Can Self-Verify Email/Phone via APIGo · github.com/zitadel/zitadel · fixed in 1.80.0-v2.20.0.20260608144108-ed09b3df7f43
- CVE-2026-54735prebid-server's request forgery vulnerability allows for possible host environment data extractionGo · github.com/prebid/prebid-server, github.com/prebid/prebid-server/v2 +2 · fixed in 4.4.0
- CVE-2026-54650openhole-server vulnerable to path traversal via URL-decoded request pathGo · github.com/bablilayoub/openhole · fixed in 0.1.2
- CVE-2026-54638td has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.DecodeGo · github.com/gotd/td · fixed in 0.145.1
- CVE-2026-66064goshs has ACL Bypass & Path TraversalGo · github.com/patrickhener/goshs, github.com/patrickhener/goshs/v2 +2 · fixed in 2.1.5-0.20260727065949-f3ef599e4091
- CVE-2026-66063goshs has a Path Traversal issueGo · github.com/patrickhener/goshs, github.com/patrickhener/goshs/v2 +2 · fixed in 2.1.5-0.20260727065949-f3ef599e4091
- CVE-2026-64863goshs --no-delete WebDAV MOVE bypass allows file deletion/overwriteGo · github.com/patrickhener/goshs, github.com/patrickhener/goshs/v2 +2 · fixed in 2.1.4
- CVE-2026-54719goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of CVE-2026-40189)Go · github.com/patrickhener/goshs, github.com/patrickhener/goshs/v2 +2 · fixed in 2.1.1
- CVE-2026-62325goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)Go · github.com/patrickhener/goshs/v2, goshs.de/goshs +1 · fixed in 2.1.4
- CVE-2026-49447Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokensGo · github.com/azukaar/cosmos-server · fixed in 0.22.19
- CVE-2026-49258Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)Go · github.com/juev/nebula-mesh
- CVE-2026-48058nebula-mesh: Session and OIDC state cookies lack the Secure attributeGo · github.com/juev/nebula-mesh · fixed in 0.3.2
- CVE-2026-47768nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs)Go · github.com/juev/nebula-mesh · fixed in 0.3.2
- CVE-2026-47726nebula-mesh: GET /api/v1/audit-log discloses all entries to any operatorGo · github.com/juev/nebula-mesh · fixed in 0.3.2
- CVE-2026-47725nebula-mesh: Web UI lacks CSRF tokens on /ui/* mutating endpointsGo · github.com/juev/nebula-mesh · fixed in 0.3.3
- CVE-2026-48025nebula-mesh: Decrypted CA private key persists in heap after signingGo · github.com/forgekeep/nebula-mesh, github.com/juev/nebula-mesh · fixed in 0.3.7
- CVE-2026-54332GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoSGo · github.com/gopacket/gopacket · fixed in 1.6.1
- CVE-2026-54345GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS)Go · github.com/gopacket/gopacket · fixed in 1.6.1
- CVE-2026-54593Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissionsGo · github.com/pterodactyl/wings · fixed in 1.12.2
- CVE-2026-47427GitHub MCP Server: Nil Pointer Dereference DoS in completion/complete HandlerGo · github.com/github/github-mcp-server · fixed in 1.1.0