Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-53433Denial of Service in fzfGo · github.com/junegunn/fzf · fixed in 0.73.1
- CVE-2026-41053Over-inclusive team membership expansion in GitHub App authentication provider for RancherGo · github.com/rancher/rancher · fixed in 2.14.2, 2.13.6, 0.0.0-20260519172014-d0c047bbc6d2
- CVE-2026-11720Path Traversal in googleapis/mcp-toolbox HTTP Tool URL BuilderGo · github.com/googleapis/mcp-toolbox · fixed in 1.3.0
- CVE-2026-41052Rancher Privilege Escalation from Project Owner to HostGo · github.com/rancher/rancher · fixed in 0.0.0-20260513182521-2800aaac25b5, 2.14.2, 2.13.6 and more
- CVE-2026-46604Panic decoding image with out-of-bounds strip offset in x/image/tiff in golang.org/x/imageGo · golang.org/x/image · fixed in 0.43.0
- CVE-2026-48529GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusionGo · github.com/github/github-mcp-server · fixed in 1.1.2
- CVE-2026-55686Podman: WORKDIR symlink traversal vulnerabilityGo · github.com/containers/podman, github.com/containers/podman/v2 +3 · fixed in 5.7.1
- CVE-2026-57231Podman: Malformed Image can trick podman run into leaking host environment variables into the containerGo · github.com/containers/libpod, github.com/containers/podman +5 · fixed in 5.8.4, 6.0.0
- CVE-2026-28385SSRF via image import from URL allows internal network probing by authenticated usersGo · github.com/canonical/lxd · fixed in 0.0.0-20261005133302-c4a919f3f4e2
- CVE-2026-55677Echo: Encoded slash (%2F) bypasses route-level protection and exposes static filesGo · github.com/labstack/echo, github.com/labstack/echo/v4 +1 · fixed in 4.15.3, 5.2.0
- CVE-2026-9639Authenticated Denial of Service via Malicious Backup Tarball in LXDGo · github.com/canonical/lxd · fixed in 0.0.0-20260622081844-85f897013ccd
- CVE-2026-12411Broken Access Control in Canonical LXD DevLXD APIGo · github.com/canonical/lxd · fixed in 0.0.0-20260626085133-7cb96ac80a6d
- CVE-2026-13426Client4 fails to validate path parametersGo · github.com/mattermost/mattermost/server/public · fixed in 0.1.22
- CVE-2026-13322Kubevirt: virt-handler-rhel9: kubevirt: unbounded virtio-serial readline in virt-handler causes oom denial of serviceGo · github.com/kubevirt/kubevirt, kubevirt.io/kubevirt
- CVE-2026-13318Virt-api-rhel9: kubevirt: kubevirt: ssrf in virt-api port-forward via unvalidated guest-agent-reported ipGo · kubevirt.io/kubevirt · fixed in 1.10.0-rc.0
- CVE-2026-13218Kubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcherGo · kubevirt.io/kubevirt
- CVE-2026-46602Lack of limit on tile sizes in x/image/tiff in golang.org/x/imageGo · golang.org/x/image · fixed in 0.43.0
- CVE-2026-46601Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/imageGo · golang.org/x/image · fixed in 0.43.0
- CVE-2026-54917SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket accessGo · github.com/seaweedfs/seaweedfs · fixed in 0.0.0-20260526080459-dd1b4287899e
- CVE-2026-54250K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot DecompressionGo · github.com/k3s-io/k3s · fixed in 1.35.3, 1.34.6, 1.33.10
- CVE-2026-54090File Browser: Command Allowlist Bypass via Shell Metacharacter InjectionGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.33.8
- CVE-2026-54088File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)Go · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.63.6
- CVE-2026-54089File Browser: Authentication Bypass via Proxy Auth Header ForgeryGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2
- CVE-2026-54091File Browser: Incorrect access control in public directory shares via rule path rebasingGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.63.6
- CVE-2026-54092File Browser: DoS Vulnerability on Public Login APIGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.63.6
- CVE-2026-54097File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefixGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.63.6
- CVE-2026-54093File Browser: Path traversal in download-as-zip/tar via Windows-style backslash separators in stored filenamesGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.63.6
- CVE-2026-54094File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scopeGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.63.14
- CVE-2026-54096File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent PathGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.63.7
- CVE-2026-55667File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanupGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.63.16