Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-54764ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=falseGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.51, 3.6.22, 3.7.6
- CVE-2026-50135Hugo: Symlink confinement bypass in resources.GetGo · github.com/gohugoio/hugo · fixed in 0.162.0
- CVE-2026-50134Hugo: security.http.urls allow-list bypass via HTTP redirectsGo · github.com/gohugoio/hugo · fixed in 0.162.0
- CVE-2026-50133Hugo: XSS via text/html content filesGo · github.com/gohugoio/hugo · fixed in 0.162.0
- CVE-2026-58403Hugo symlink confinement bypass in os.ReadFileGo · github.com/gohugoio/hugo · fixed in 0.163.1
- CVE-2026-58402Hugo default code block renderer XSS via unescaped code-fence languageGo · github.com/gohugoio/hugo · fixed in 0.163.3
- CVE-2026-58404Hugo security.http.urls deny rules bypassed by alternate IPv4 encodingsGo · github.com/gohugoio/hugo · fixed in 0.163.1
- CVE-2026-44937SUSE Rancher Fleet had an Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL ComponentsGo · github.com/rancher/fleet · fixed in 0.15.2, 0.14.6, 0.13.11 and more
- CVE-2026-44936Rancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yamlGo · github.com/rancher/fleet · fixed in 0.15.2, 0.14.6, 0.13.11 and more
- CVE-2026-58426Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state writeGo · code.gitea.io/gitea · fixed in 1.26.2
- CVE-2026-58424Permanent Fork PR Workflow Approval Gate BypassGo · code.gitea.io/gitea · fixed in 1.26.3
- CVE-2026-58423LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositoriesGo · code.gitea.io/gitea · fixed in 1.26.3
- CVE-2026-58422Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accountsGo · code.gitea.io/gitea · fixed in 1.26.4
- CVE-2026-58421Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of serviceGo · code.gitea.io/gitea · fixed in 1.26.4
- CVE-2026-58419Notification API leaks private issue metadata after access revocationGo · code.gitea.io/gitea · fixed in 1.26.4
- CVE-2026-58418SSRF via HTTP Redirect in Repository MigrationGo · code.gitea.io/gitea · fixed in 1.26.4
- CVE-2026-28744Gitea Git smart HTTP bypasses repository token scopes for bearer tokensGo · code.gitea.io/gitea · fixed in 1.26.2
- CVE-2026-28740Gitea LFS object reuse bypasses Code-unit authorizationGo · code.gitea.io/gitea, gitea.dev · fixed in 1.26.3
- CVE-2026-28737Gitea 3D file viewer allows stored XSS through glTF extensionsRequiredGo · code.gitea.io/gitea · fixed in 1.26.0
- CVE-2026-28705Gitea repository dumps write release assets using unsafe path namesGo · code.gitea.io/gitea · fixed in 1.25.5
- CVE-2026-28699Gitea Basic Auth bypasses OAuth2 access token scopesGo · code.gitea.io/gitea · fixed in 1.26.2
- CVE-2026-27783Gitea issue-template APIs bypass repository unit authorizationGo · code.gitea.io/gitea · fixed in 1.26.2
- CVE-2026-27780Gitea pre-receive hook can miss branch-protection checks after scanner errorsGo · code.gitea.io/gitea · fixed in 1.26.0
- CVE-2026-27779Gitea forwarded-proto handling allows public URL spoofingGo · code.gitea.io/gitea · fixed in 1.25.5
- CVE-2026-27775Gitea pre-receive hook permission cache allows full repository write accessGo · code.gitea.io/gitea · fixed in 1.26.3
- CVE-2026-27771Gitea Composer package source links use insufficient permission checksGo · code.gitea.io/gitea · fixed in 1.26.2
- CVE-2026-27761Gitea repository feeds bypass API token scope enforcementGo · code.gitea.io/gitea · fixed in 1.26.3
- CVE-2026-27660Gitea draft releases use insufficient permission checksGo · code.gitea.io/gitea · fixed in 1.25.5
- CVE-2026-27657Gitea email settings allow changing another user's primary email addressGo · code.gitea.io/gitea · fixed in 1.25.5
- CVE-2026-26307Gitea git grep search lacks a timeoutGo · code.gitea.io/gitea · fixed in 1.25.5