Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-25119Gogs: Authentication Bypass via Unvalidated Reverse Proxy HeadersGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2025-64719Gogs: Denial of Service in repository/wiki file listing web pagesGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-52815Gogs: Unauthenticated Organization Teams Information Disclosure via APIGo · gogs.io/gogs · fixed in 0.14.3
- CVE-2026-49980Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fixGo · github.com/ncw/rclone, github.com/rclone/rclone · fixed in 1.74.3
- CVE-2026-12681Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Google go-attestation.Go · github.com/google/go-attestation · fixed in 0.6.1
- CVE-2026-54762Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution failsGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 3.7.5
- CVE-2026-54761Traefik: Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist to expose internal Traefik servicesGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 3.6.21, 3.7.5
- CVE-2026-53622Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hostsGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.51, 3.7.3, 3.6.18
- CVE-2026-48491Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypassGo · github.com/traefik/traefik/v2, github.com/traefik/traefik/v3 · fixed in 2.11.48, 3.7.3
- CVE-2026-48020Traefik StripPrefix Route-Level Auth Bypass via Path NormalizationGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.48, 3.6.19, 3.7.3
- CVE-2026-54321Daytona: Public sandbox previews remain accessible for up to one hour after being made privateGo · github.com/daytonaio/daytona · fixed in 0.184.0
- CVE-2026-54319Daytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escapeGo · github.com/daytonaio/daytona · fixed in 0.186.0
- CVE-2026-54322Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's rolesGo · github.com/daytonaio/daytona · fixed in 0.185.0
- CVE-2026-54324Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId joinGo · github.com/daytonaio/daytona · fixed in 0.185.0
- CVE-2026-45135Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP FilesGo · github.com/caddyserver/caddy/v2 · fixed in 2.11.3
- CVE-2026-45692Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index NormalizationGo · github.com/caddyserver/caddy/v2 · fixed in 2.11.3
- CVE-2026-52845Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`Go · github.com/caddyserver/caddy, github.com/caddyserver/caddy/v2 · fixed in 2.11.4
- CVE-2026-52844Caddy: Windows `file_server` path authorization bypass via encoded backslashGo · github.com/caddyserver/caddy, github.com/caddyserver/caddy/v2 · fixed in 2.11.4
- CVE-2026-52846Caddy: stripHTML template function bypassGo · github.com/caddyserver/caddy, github.com/caddyserver/caddy/v2 · fixed in 2.11.4
- CVE-2026-10609Openshift/cluster-logging-operator: cluster logging operator creates and forwards serviceaccount tokens without verifying clf creator authorizationGo · github.com/openshift/cluster-logging-operator · fixed in 0.0.0-20260804174055-1864c2a9851d
- CVE-2023-54365Traefik - Denial of Service via HTTP/2 Request HandlingGo · github.com/traefik/traefik · fixed in 2.10.5, 3.0.0-beta4
- CVE-2026-39904Gophish 0.12.1 Denial of Service via Office Document UploadGo · github.com/gophish/gophish
- CVE-2026-42127Pre-authentication denial of service in the public dashboard query endpointGo · github.com/grafana/grafana · fixed in 1.9.2-0.20260616075434-82ef13993059
- CVE-2026-12249Canonical ADSys Trust Store Poisoning via Plaintext HTTP Certificate Auto-EnrollmentGo · github.com/ubuntu/adsys · fixed in 0.16.3-0.20250318112551-8b1939f96d38
- CVE-2026-8823User Manager can demote bot accounts to guest without bot-management permissionGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.18+incompatible, 11.7.1+incompatible, 11.7.1 and more
- CVE-2026-6062IDOR in Jira plugin subscription edit endpointGo · github.com/mattermost/mattermost-server · fixed in 11.7.1, 11.6.3, 11.5.6 and more
- CVE-2026-6673Mattermost Jira plugin had unauthenticated {{/ac/installed}} lifecycle callback during pending Jira Cloud installGo · github.com/mattermost/mattermost-server · fixed in 10.11.18+incompatible, 11.5.6+incompatible, 11.6.3+incompatible and more
- CVE-2026-8074Improper Permission Check Allows User Manager to Deactivate Bot AccountsGo · github.com/mattermost/mattermost-server · fixed in 10.11.18+incompatible, 11.7.1+incompatible, 11.7.1 and more
- CVE-2026-9162Global session revocation does not invalidate active WebSocket connectionsGo · github.com/mattermost/mattermost-server · fixed in 10.11.18+incompatible, 11.5.6+incompatible, 11.6.3+incompatible and more
- CVE-2026-5139GitLab Plugin Allows Non-Admin Users to Modify Default Instance ConfigurationGo · github.com/mattermost/mattermost-server · fixed in 10.11.18+incompatible, 11.5.6+incompatible, 11.6.3+incompatible and more