Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-55882Tilt: Unauthenticated pprof debug endpoints on the Tilt HUD serverGo · github.com/tilt-dev/tilt · fixed in 0.37.4
- CVE-2026-55884Tilt: Missing authentication on the network-exposed Tilt HUD serverGo · github.com/tilt-dev/tilt · fixed in 0.37.4
- CVE-2026-59155Nezha Monitoring: DDNS and Notification credential exposure via unredacted list APIGo · github.com/nezhahq/nezha · fixed in 2.2.5
- CVE-2026-55229Gotenberg: SSRF via LibreOffice document processingGo · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8 · fixed in 8.34.0
- CVE-2026-56668ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token ExchangeGo · github.com/zitadel/zitadel · fixed in 4.15.3
- CVE-2026-56666ZITADEL: Auto-linking by email: IdP-side email verification is not checkedGo · github.com/zitadel/zitadel · fixed in 4.15.3
- CVE-2026-56665ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP ProviderGo · github.com/zitadel/zitadel · fixed in 4.15.2, 3.4.12
- CVE-2026-56664ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP ProviderGo · github.com/zitadel/zitadel · fixed in 1.80.0-v2.20.0.20260615122908-fad02c6d9f45
- CVE-2026-55672ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation)Go · github.com/zitadel/zitadel · fixed in 1.80.0-v2.20.0.20260616131956-0973b074b488
- CVE-2026-55671ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP ComponentsGo · github.com/zitadel/zitadel · fixed in 1.80.0-v2.20.0.20260615133614-8e82ec1cb9a2
- CVE-2026-55670ZITADEL: Cross-Tenant User Leakage via Recycled IdentifiersGo · github.com/zitadel/zitadel · fixed in 1.80.0-v2.20.0.20260615092437-6082e59d47c1
- CVE-2026-55669ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP ProviderGo · github.com/zitadel/zitadel · fixed in 1.80.0-v2.20.0.20260615132747-d184e976fc79
- CVE-2026-54063Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS)Go · github.com/xuri/excelize/v2 · fixed in 2.11.0
- CVE-2026-59162Excelize: Negative shared-string index causes panic in GetCellValue and GetRowsGo · github.com/xuri/excelize, github.com/xuri/excelize/v2 · fixed in 2.11.0
- CVE-2026-59161Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocationGo · github.com/xuri/excelize, github.com/xuri/excelize/v2 · fixed in 2.11.0
- CVE-2026-53657Lima: An arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socketGo · github.com/lima-vm/lima, github.com/lima-vm/lima/v2 · fixed in 2.1.3
- CVE-2026-56765Vikunja - Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDORGo · code.vikunja.io/api · fixed in 2.2.1
- CVE-2026-44342New API CSRF in email and WeChat account binding endpointsGo · github.com/quantumnous/new-api · fixed in 0.12.0-alpha.1
- CVE-2026-33655New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLsGo · github.com/quantumnous/new-api · fixed in 0.12.0-alpha.1
- CVE-2026-59832SiYuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.dbGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260704035520-68cc0f537dfa
- CVE-2026-59834SiYuan: SQL Query in Block Search Exposes Hidden Published Document ContentGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260704035518-d0f0fe146fb0
- CVE-2026-55689OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unsetGo · github.com/openfga/openfga · fixed in 1.18.0
- CVE-2026-55170OpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisionsGo · github.com/openfga/openfga · fixed in 1.18.0
- CVE-2026-44332Fiber: Username Enumeration via Timing Oracle in BasicAuth Default AuthorizerGo · github.com/gofiber/fiber/v3 · fixed in 3.3.0
- CVE-2026-53624Fiber: HSTS header never set in helmet middleware due to incorrect protocol checkGo · github.com/gofiber/fiber, github.com/gofiber/fiber/v3 · fixed in 3.4.0
- CVE-2026-45045Fiber: X-Real-IP Spoofing via Header.Add() in BalancerForwardGo · github.com/gofiber/fiber/v2, github.com/gofiber/fiber/v3 · fixed in 2.52.14, 3.3.0
- CVE-2026-42505Invoking Encrypted Client Hello privacy leak in crypto/tlsGo · stdlib · fixed in 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-39822Root escape via symlink plus trailing slash in osGo · stdlib · fixed in 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-55761Portainer: Unauthenticated Restore Endpoint Allows Admin Takeover on Uninitialised Portainer InstancesGo · github.com/portainer/portainer · fixed in 2.39.4, 2.43.0
- CVE-2026-55668File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scopeGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.63.16