Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- GHSA-RJWR-M7QX-3FJRoapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable CodeGo · github.com/oapi-codegen/oapi-codegen/v2 · fixed in 2.7.1
- CVE-2026-49835Sigstore Timestamp Authority: OOM due to unbounded metric label cardinalityGo · github.com/sigstore/timestamp-authority, github.com/sigstore/timestamp-authority/v2 · fixed in 2.1.0
- CVE-2026-44982CrowdSec AppSec silently drops request body for chunked / HTTP-2 requestsGo · github.com/crowdsecurity/crowdsec · fixed in 1.7.8
- CVE-2026-44981CrowdSec LAPI: Denial of Service via Unbounded Gzip DecompressionGo · github.com/crowdsecurity/crowdsec · fixed in 1.7.8
- CVE-2026-62994CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` pluginGo · github.com/coredns/coredns · fixed in 1.14.5
- CVE-2026-62290cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentialsGo · github.com/cert-manager/cert-manager · fixed in 1.19.6, 1.20.3
- CVE-2026-49998Centrifugo: Dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypassGo · github.com/centrifugal/centrifugo, github.com/centrifugal/centrifugo/v3 +3 · fixed in 6.8.1
- CVE-2026-54526Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencingGo · github.com/argoproj/argo-workflows, github.com/argoproj/argo-workflows/v2 +2 · fixed in 3.7.15, 4.0.6
- CVE-2026-46377Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted stringGo · github.com/tomwright/dasel, github.com/tomwright/dasel/v2 +1
- CVE-2026-46378Dasel: Denial of service in dasel selector lexer due to infinite loop on unterminated regex literalGo · github.com/tomwright/dasel, github.com/tomwright/dasel/v2 +1 · fixed in 3.10.1
- CVE-2026-45576zrok copy writes attacker-controlled WebDAV paths outside the destination rootGo · github.com/openziti/zrok, github.com/openziti/zrok/v2 · fixed in 2.0.3
- CVE-2026-45695Kopia: Unauthenticated RCE via SSH ProxyCommand Injection when --insecure --without-password is usedGo · github.com/kopia/kopia · fixed in 0.23.0
- CVE-2026-62314Anubis: Policy bypass via client controlled X-Original-URI headerGo · github.com/techarohq/anubis · fixed in 1.26.0
- CVE-2026-62361listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentialsGo · github.com/knadh/listmonk · fixed in 1.1.1-0.20260619102436-c0a6525009a6
- CVE-2026-45737Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotationsGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 +1 · fixed in 3.2.12, 3.3.10, 3.4.2
- CVE-2026-45738Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalationGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 +1 · fixed in 3.2.12, 3.3.10, 3.4.2
- CVE-2026-56743Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock matchGo · github.com/cilium/cilium · fixed in 1.19.5
- CVE-2026-56742Cilium: Namespaced HTTPRoutes can redirect traffic to other namespacesGo · github.com/cilium/cilium, github.com/cilium/ciliumcilium · fixed in 1.17.17, 1.19.5, 1.18.11
- CVE-2026-49445Cilium: Sensitive information disclosure and cluster disruption via local Envoy admin socket accessGo · github.com/cilium/cilium · fixed in 1.17.14, 1.18.8, 1.19.2
- CVE-2026-47703AdGuard Home: DoQ-to-UDP State Reduction and Source-Port OracleGo · github.com/adguardteam/adguardhome, github.com/adguardteam/dnsproxy · fixed in 0.107.75, 0.81.3
- CVE-2026-62685File Browser: Colliding username normalization gives two users the same home directoryGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.63.17
- CVE-2026-62843File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)Go · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.63.17
- CVE-2026-54560Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claimGo · github.com/cloudreve/cloudreve, github.com/cloudreve/cloudreve/v3 +1 · fixed in 4.0.0-20260606015557-ed20843dc3df
- CVE-2026-54563Cloudreve: Path Traversal / Broken Access Control in Cloudreve WebDAV (`/dav`) — scoped DAV credential escapes its configured account rootGo · github.com/cloudreve/cloudreve, github.com/cloudreve/cloudreve/v3 +1 · fixed in 4.0.0-20260606032813-26b6b1044b02
- CVE-2026-54562Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responsesGo · github.com/cloudreve/cloudreve, github.com/cloudreve/cloudreve/v3 +1 · fixed in 4.0.0-20260606025411-aaebf317a78f
- CVE-2026-59733rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositoriesGo · github.com/rclone/rclone · fixed in 1.74.4
- CVE-2026-54572rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remoteGo · github.com/rclone/rclone · fixed in 1.74.4
- CVE-2026-59732rclone archive extract allows S3 destination prefix escape via crafted archive pathsGo · github.com/rclone/rclone · fixed in 1.74.4
- CVE-2026-55187Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanisms (follow-up to CVE-2026-27808)Go · github.com/axllent/mailpit · fixed in 1.30.2
- CVE-2026-55883Tilt: Cross-site WebSocket hijacking of the Tilt HUD streamGo · github.com/tilt-dev/tilt · fixed in 0.37.4