Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-54448Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parserGo · github.com/aquasecurity/trivy · fixed in 0.71.0
- CVE-2026-55092Trivy: Path traversal via a crafted vulnerability database or other downloaded artifactsGo · github.com/aquasecurity/trivy · fixed in 0.71.1
- CVE-2026-55477Authenticated Arbitrary File Write via Database Import and Xray Log Path ManipulationGo · github.com/mhsanaei/3x-ui, github.com/mhsanaei/3x-ui/v2 +1 · fixed in 3.3.1
- CVE-2026-50551SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell ContentGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260628153353-2d5d72223df4
- CVE-2026-54158SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()Go · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260628153353-2d5d72223df4
- CVE-2026-54070SiYuan: Stored XSS in Bazaar marketplace via package README event handlersGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260628153353-2d5d72223df4
- CVE-2026-54069SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin AllowlistGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260628153353-2d5d72223df4
- CVE-2026-54068SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIconGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260628153353-2d5d72223df4
- CVE-2026-54067SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()Go · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260628153353-2d5d72223df4
- CVE-2026-54066SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read)Go · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260628153353-2d5d72223df4
- CVE-2026-52797Gogs: Overwriting critical files results in a denial of serviceGo · gogs.io/gogs · fixed in 0.14.0
- CVE-2026-52813Gogs: Path Traversal in organization name results in RCE through Git hooksGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-52812Gogs: LFS dedupe path leaks private repo content across tenantsGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-52811Gogs: UploadRepoFiles writes outside repo working tree via committed parent symGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-52810Gogs: Write to readonly repositories using receive-pack + service=git-upload-pack confusionGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-52809Gogs: Password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVESGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-52808Gogs: Write-level collaborators can mutate admin-only repository settings via APIGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-52816Gogs: Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSSGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-52807Gogs: DOM-based XSS via Milestone Name on New Issue PageGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-52805Gogs: Migration Redirect Bypass Leads to Internal Repository TheftGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-52806Gogs: RCE via git rebase --exec argument injection in pull request mergeGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-52804Gogs: Privilege Escalation via Collaboration Access Mode ValidationGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-52799Gogs: Missing Authorization in Attachment DownloadGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-52801Gogs: Ability to import local repositories via Mirror SettingsGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-52800Gogs: CSRF Leading to Organization Owner TakeoverGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-52802Gogs: Open Redirect via redirect_to in GogsGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-52814Gogs: Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion)Go · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-52798Gogs: Stored XSS in `.ipynb` PreviewGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-52796Gogs: DoS in rendering issue index patternGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-47267Gogs: SSRF in webhook deliveriesGo · gogs.io/gogs · fixed in 0.14.3