Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-55873SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table bucketsGo · github.com/seaweedfs/seaweedfs · fixed in 0.0.0-20260614205536-b13463880c1f
- CVE-2026-55874SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object readGo · github.com/seaweedfs/seaweedfs · fixed in 0.0.0-20260612000715-b44cf51fe931
- CVE-2026-44840Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL QueryGo · github.com/dgraph-io/dgraph, github.com/dgraph-io/dgraph/v25 +1 · fixed in 25.3.4
- CVE-2026-54061Dgraph Alpha group stores can be replaced via unauthenticated external snapshot importGo · github.com/dgraph-io/dgraph, github.com/dgraph-io/dgraph/v25 · fixed in 25.3.5
- CVE-2026-55438Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofingGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.29.17, 2.32.7, 2.33.8 and more
- CVE-2026-55437Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine componentGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.29.17, 2.32.7, 2.33.8 and more
- CVE-2026-55436Coder's AI Bridge Proxy skips TLS certificate verification in default configurationGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.32.7, 2.33.8, 2.34.2
- CVE-2026-55433Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containersGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.34.2, 2.33.8, 2.32.7 and more
- CVE-2026-55432Coder's sub-agent app registration bypasses template port-sharing policy enforcementGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.34.2, 2.33.8, 2.32.7 and more
- CVE-2026-55431Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace appsGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.29.17, 2.32.7, 2.33.8 and more
- CVE-2026-55430Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data accessGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.34.2, 2.33.8, 2.32.7 and more
- CVE-2026-55429Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app IDGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.29.17, 2.32.7, 2.33.8 and more
- CVE-2026-55428Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinatorGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.29.17, 2.32.7, 2.33.8 and more
- CVE-2026-55427Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`Go · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.29.17, 2.32.7, 2.33.8 and more
- CVE-2026-55079Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of serviceGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.34.2, 2.33.8, 2.32.7 and more
- CVE-2026-55078Coder: Zip upload decompression lacks aggregate size limit, enabling denial of serviceGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.29.17, 2.32.7, 2.33.8 and more
- CVE-2026-55077Coder: User-admin role can reset owner account passwordGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.34.2, 2.33.8, 2.32.7 and more
- CVE-2026-55076Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linkingGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.34.2, 2.33.8, 2.32.7 and more
- GO-2026-5932The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issuesGo · golang.org/x/crypto
- CVE-2026-55075Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypassGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.29.17, 2.32.7, 2.33.8 and more
- CVE-2026-46354Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theftGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.24.5, 2.29.13, 2.30.8 and more
- CVE-2026-45796Coder vulnerable to unauthenticated SSRF via Azure Instance Identity EndpointGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.33.3, 2.32.2, 2.31.12 and more
- CVE-2026-53935CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translationGo · github.com/cilium/cilium · fixed in 1.19.4, 1.18.10, 1.17.16
- CVE-2026-59707LocalAI - Server-Side Request Forgery via POST /models/applyGo · github.com/mudler/localai · fixed in 1.40.1-0.20260703213242-2cbb3c96b34d
- CVE-2026-44454Coder vulnerable to workspace auto-creation via crafted URL parameters without user consentGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.29.7, 2.30.2
- CVE-2026-55434Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpointsGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.33.8, 2.34.2
- CVE-2026-55435Suspended Coder users retain access to AI Bridge LLM proxy endpointsGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.32.7, 2.33.8, 2.34.2
- CVE-2026-44938Fleet has PSS Bypass through addLabelsFromOptions in Fleet AgentGo · github.com/rancher/fleet · fixed in 0.12.15, 0.13.11, 0.14.6 and more
- CVE-2026-54763Traefik: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuthGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.51, 3.6.22, 3.7.6
- CVE-2026-54765Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:portGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 3.7.6