Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-62160Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddlewareGo · github.com/daptin/daptin
- CVE-2026-119298croc: Overwrite-confirmation bypass via a crafted "croc-stdin-" filename on receiveGo · github.com/schollz/croc, github.com/schollz/croc/v10 +4 · fixed in 11.5.2
- GHSA-F3FJ-9625-RV3Mcharmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated usersGo · github.com/charmbracelet/soft-serve · fixed in 0.12.3
- GHSA-FGXM-5HVV-X4VHcharmbracelet/soft-serve HTTP responses disclose the existence and names of private repositoriesGo · github.com/charmbracelet/soft-serve · fixed in 0.12.3
- CVE-2026-119285Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin readsGo · github.com/gofiber/fiber/v2 · fixed in 2.52.3
- CVE-2026-118761Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memoryGo · github.com/kubeflow/pipelines · fixed in 0.0.0-20260831164314-ba9ae72cc860
- CVE-2026-118759Kubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing pod execution logs cross-tenantGo · github.com/kubeflow/pipelines · fixed in 0.0.0-20260904182349-be4723e33727
- CVE-2026-118658Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-ProtoGo · github.com/labstack/echo/v4, github.com/labstack/echo/v5 · fixed in 4.15.2, 5.1.1
- CVE-2026-118657Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme HeadersGo · github.com/labstack/echo/v4, github.com/labstack/echo/v5 · fixed in 4.16.0, 5.4.0
- CVE-2026-118656Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURIGo · github.com/labstack/echo/v4, github.com/labstack/echo/v5 · fixed in 4.16.0, 5.4.0
- CVE-2026-118655Echo: Static Middleware Double-Unescape Path TraversalGo · github.com/labstack/echo/v4, github.com/labstack/echo/v5 · fixed in 4.15.3, 5.2.0
- CVE-2026-118654Echo static file middleware route protection bypass via encoded dot-dot traversalGo · github.com/labstack/echo/v4, github.com/labstack/echo/v5 · fixed in 4.16.0, 5.4.0
- CVE-2026-54162Ember: Unneutralised terminal escape/control sequences from Caddy logs injected into the operator's TUIGo · github.com/alexandre-daubois/ember · fixed in 1.4.2
- CVE-2026-118653Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default ConfigurationGo · github.com/labstack/echo/v4, github.com/labstack/echo/v5 · fixed in 5.1.0
- CVE-2026-118652Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlobGo · github.com/labstack/echo/v4, github.com/labstack/echo/v5 · fixed in 4.16.0, 5.4.0
- CVE-2026-118651Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by DefaultGo · github.com/labstack/echo/v4, github.com/labstack/echo/v5 · fixed in 5.4.0
- CVE-2026-118650Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served pathGo · github.com/labstack/echo/v4, github.com/labstack/echo/v5 · fixed in 4.16.0, 5.4.0
- CVE-2026-118266Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe MethodGo · github.com/labstack/echo/v4, github.com/labstack/echo/v5 · fixed in 4.16.0, 5.4.0
- CVE-2026-118265Echo: X-Real-IP extractor trusts the header value instead of the sending peerGo · github.com/labstack/echo/v5 · fixed in 5.4.1
- CVE-2026-118264Echo: Rejected WebSocket upgrades can bypass Echo route-level access controlsGo · github.com/labstack/echo/v4, github.com/labstack/echo/v5 · fixed in 4.16.1, 5.4.1
- CVE-2026-118263Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requestsGo · github.com/labstack/echo/v5 · fixed in 5.4.1
- CVE-2026-118262Echo: WebSocket proxy can retain connections and handlers after client disconnectGo · github.com/labstack/echo/v4, github.com/labstack/echo/v5 · fixed in 4.16.1, 5.4.1
- CVE-2026-118261Echo: Decompress permits unbounded gzip expansion in v4Go · github.com/labstack/echo/v4 · fixed in 4.16.1
- CVE-2026-118260Echo: BodyDump captures request and response bodies without size limits in v4Go · github.com/labstack/echo/v4 · fixed in 4.16.1
- CVE-2026-97045Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/netGo · golang.org/x/net, golang.org/x/net/html · fixed in 0.62.0
- CVE-2026-78661Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/netGo · golang.org/x/net, golang.org/x/net/html · fixed in 0.62.0
- CVE-2026-116683CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive valuesGo · github.com/ctfer-io/terraform-provider-ctfd, github.com/ctfer-io/terraform-provider-ctfd/v2 · fixed in 2.8.2
- CVE-2026-116682FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directoryGo · github.com/gtsteffaniak/filebrowser/backend · fixed in 0.0.0-20260814233832-4126edeb07a0
- CVE-2026-116679Neko: Authorization bypass in legacy WebRTC input handlingGo · github.com/m1k1o/neko/server · fixed in 0.0.0-20260805142851-395ca1a6f62b
- CVE-2026-116676Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during planGo · github.com/runatlantis/atlantis · fixed in 0.47.1