Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-66394SiYuan before v3.7.3 Stored and Reflected XSS via SVG Sanitizer BypassGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260714095344-f08dee71ba8e
- CVE-2026-43871Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limitGo · github.com/apache/thrift · fixed in 0.24.0
- CVE-2026-47724nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalationGo · github.com/juev/nebula-mesh · fixed in 0.3.4
- CVE-2026-47723nebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.)Go · github.com/juev/nebula-mesh · fixed in 0.3.1
- CVE-2026-47722nebula-mesh: Host advanced overrides allow YAML injection into agent config.ymlGo · github.com/juev/nebula-mesh · fixed in 0.3.2
- CVE-2026-44210Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod AnnotationsGo · github.com/kata-containers/kata-containers · fixed in 0.0.0-20260519062212-ffa59ce3aa78
- CVE-2026-65607SiYuan before v3.7.2 Path Traversal via /export/temp/Go · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260510110132-b763d787d1f2
- CVE-2026-65602Traefik before 3.6.23 IngressRouteTCP ServersTransport Namespace BypassGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 3.6.23, 3.7.7
- CVE-2026-65601Traefik before 3.7.7 Namespace Confusion via HTTPRoute ExtensionRefGo · github.com/traefik/traefik, traefik · fixed in 3.7.7
- CVE-2026-65600Traefik before v2.11.52 Authentication Bypass via ReplacePathRegexGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.52, 3.6.23, 3.7.7
- CVE-2026-47671Nhost CLI local configserver allows cross-origin unauthenticated read/write access to local development configuration and secretsGo · github.com/nhost/nhost · fixed in 0.0.0-20260518172022-e407511627d2
- CVE-2026-46403Klever-Go KVM read-only execution can commit contract delete and upgrade side effectsGo · github.com/klever-io/klever-go · fixed in 1.7.17
- CVE-2026-56852Infinite loop on invalid input in golang.org/x/textGo · golang.org/x/text · fixed in 0.39.0
- CVE-2026-46600Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessageGo · golang.org/x/net, stdlib · fixed in 0.56.0, 1.26.6, 1.27.0-rc.3
- CVE-2026-46415Caddy Defender trusted proxy client IP bypassGo · pkg.jsn.cam/caddy-defender · fixed in 0.10.1
- CVE-2026-48824Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw)Go · github.com/axllent/mailpit · fixed in 1.30.1
- CVE-2026-45713Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizesGo · github.com/axllent/mailpit · fixed in 1.30.0
- CVE-2026-45712Mailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write)Go · github.com/axllent/mailpit · fixed in 1.30.0
- CVE-2026-45711Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDsGo · github.com/axllent/mailpit · fixed in 1.30.0
- CVE-2026-45709Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialerGo · github.com/axllent/mailpit · fixed in 1.30.0
- CVE-2026-54910FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary filesGo · github.com/gtsteffaniak/filebrowser/backend · fixed in 0.0.0-20260608182036-f3f4bbe80cb5
- CVE-2026-54685FileBrowser Quantum has Username Enumeration via Authentication Timing Side-ChannelGo · github.com/gtsteffaniak/filebrowser/backend · fixed in 0.0.0-20260317230626-af08800667b8
- CVE-2026-46410FileBrowser Quantum: unauthenticated user share share infoGo · github.com/gtsteffaniak/filebrowser, github.com/gtsteffaniak/filebrowser/backend · fixed in 1.2.1-stable.0.20260514154726-1802e1281135, 0.0.0-20260514154726-1802e1281135
- CVE-2026-50274dd-trace-go: Improper parsing of W3C baggage headers may lead to DoSGo · github.com/datadog/dd-trace-go, github.com/datadog/dd-trace-go/v2 · fixed in 2.8.1
- CVE-2026-50151oras-go: credential forwarding via unvalidated Location header in blob uploadGo · oras.land/oras-go/v2 · fixed in 2.6.1
- CVE-2026-50162oras-go: file store write outside workingDir via symlink traversalGo · oras.land/oras-go/v2 · fixed in 2.6.1
- CVE-2026-50163oras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in `oras-go` tar extractionGo · oras.land/oras-go/v2 · fixed in 2.6.2
- CVE-2026-48978oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokensGo · oras.land/oras-go, oras.land/oras-go/v2 · fixed in 2.6.1
- CVE-2026-50197Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding: chunked / HTTP/2 requestsGo · github.com/zalando/skipper · fixed in 0.26.10
- CVE-2026-49834sigstore-go: Multi-log threshold bypass via single compromised logGo · github.com/sigstore/sigstore-go · fixed in 1.2.0