Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-26292Gitea LFS mirror synchronization bypasses migration HTTP transport restrictionsGo · code.gitea.io/gitea · fixed in 1.25.5
- CVE-2026-26247Gitea OAuth2 PKCE S256 challenges are not enforced during token exchangeGo · code.gitea.io/gitea · fixed in 1.25.5
- CVE-2026-26232Gitea OAuth2 authorization codes lack expiry and reuse enforcementGo · code.gitea.io/gitea · fixed in 1.25.5
- CVE-2026-26231Gitea maintainer-edit permissions allow unauthorized commits to readable repositoriesGo · code.gitea.io/gitea · fixed in 1.26.2
- CVE-2026-25782Gitea tracked-time deletion can target entries from another issueGo · code.gitea.io/gitea · fixed in 1.25.5
- CVE-2026-25779Gitea redirect handling permits open redirects through backslash pathsGo · code.gitea.io/gitea, github.com/go-gitea/gitea · fixed in 1.26.0
- CVE-2026-25718Gitea template repository generation mishandles symlinked pathsGo · code.gitea.io/gitea · fixed in 1.25.5
- CVE-2026-25714Gitea user organization API bypasses public-only token filteringGo · code.gitea.io/gitea · fixed in 1.26.2
- CVE-2026-25712Gitea organization permission APIs expose private visibility informationGo · code.gitea.io/gitea · fixed in 1.25.5
- CVE-2026-25038Gitea private organization labels are visible to unauthorized usersGo · code.gitea.io/gitea · fixed in 1.26.3
- CVE-2026-24690Gitea pull-request branch updates use insufficient permission checksGo · code.gitea.io/gitea · fixed in 1.25.5
- CVE-2026-24451Gitea fork synchronization can expose private parent repository dataGo · code.gitea.io/gitea · fixed in 1.26.3
- CVE-2026-22874Gitea webhook and migration allow-list filtering permits SSRFGo · code.gitea.io/gitea · fixed in 1.26.3
- CVE-2026-22555Gitea organization forks can expose organization secrets without create permissionGo · code.gitea.io/gitea · fixed in 1.26.0
- CVE-2026-22547Gitea repository creation accepts invalid field valuesGo · code.gitea.io/gitea · fixed in 1.25.5
- CVE-2026-20909Gitea tracked-time list endpoint has insufficient permission checksGo · code.gitea.io/gitea · fixed in 1.25.5
- CVE-2026-20896Gitea Docker image trusts spoofable reverse-proxy headers by defaultGo · code.gitea.io/gitea · fixed in 1.26.3
- CVE-2026-20779Gitea TOTP single-use enforcement defect allows OTP replayGo · code.gitea.io/gitea · fixed in 1.26.3
- CVE-2026-20706Gitea repository archive downloads bypass token scope checksGo · code.gitea.io/gitea · fixed in 1.26.2
- CVE-2026-44935Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm DeployerGo · github.com/rancher/fleet · fixed in 0.12.15, 0.13.11, 0.14.6 and more
- CVE-2026-54908Pion DTLS: Denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange messageGo · github.com/pion/dtls/v3 · fixed in 3.1.4
- CVE-2026-53489containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restoreGo · github.com/containerd/containerd, github.com/containerd/containerd/v2 · fixed in 2.1.9, 2.2.5, 2.3.2
- CVE-2026-53492containerd CRI checkpoint restore CDI annotation smugglingGo · github.com/containerd/containerd, github.com/containerd/containerd/v2 · fixed in 2.1.9, 2.2.5, 2.3.2
- CVE-2026-50195containerd: CRI checkpoint import allows local image tag poisoningGo · github.com/containerd/containerd, github.com/containerd/containerd/v2 · fixed in 2.1.9, 2.2.5, 2.3.2
- CVE-2026-47262containerd image-triggered runtime DoS via unbounded group parsingGo · github.com/containerd/containerd, github.com/containerd/containerd/v2 · fixed in 1.7.33, 2.0.10, 2.1.9 and more
- CVE-2026-46680containerd user ID handling bypass allows runAsNonRoot evasionGo · github.com/containerd/containerd, github.com/containerd/containerd/v2 · fixed in 1.7.32, 2.0.9, 2.2.4 and more
- CVE-2026-53488containerd CRI plugin: — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pullGo · github.com/containerd/containerd, github.com/containerd/containerd/v2 · fixed in 1.7.33, 2.0.10, 2.1.9 and more
- CVE-2026-41579runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violationsGo · github.com/opencontainers/runc · fixed in 1.3.6, 1.4.3, 1.5.0-rc.3
- CVE-2026-58372SeaweedFS < 4.34 - Cross-Bucket Object Deletion via DeleteObjects Request-Body KeysGo · github.com/seaweedfs/seaweedfs · fixed in 0.0.0-20260526080459-dd1b4287899e
- CVE-2026-58167Nightingale < 9.0.0-beta.2 - Datasource Credential Disclosure to Low-Privilege UsersGo · github.com/ccfos/nightingale, github.com/ccfos/nightingale/v4 +2 · fixed in 6.7.3-0.20260528033214-762819fbaa23