Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-9029Stored XSS in the Geomap panel tile-layer attributionGo · github.com/grafana/grafana · fixed in 1.9.2-0.20260616075434-82ef13993059
- CVE-2026-10601Path traversal in the Tempo and Loki data source pluginsGo · github.com/grafana/grafana · fixed in 1.9.2-0.20260616075434-82ef13993059
- CVE-2026-42129Path traversal in the Loki data source pluginGo · github.com/grafana/grafana · fixed in 1.9.2-0.20260616075434-82ef13993059
- CVE-2026-56397SiYuan - Remote Code Execution via Malicious Bazaar Package Metadata and READMEGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260317012524-fe4523fff2c8
- CVE-2026-48794Authelia has an Edge Case Access Control Rule MismatchGo · github.com/authelia/authelia, github.com/authelia/authelia/v4 · fixed in 4.39.20
- CVE-2026-47203Authelia Missing Username Canonicalization in Basic Auth (LDAP)Go · github.com/authelia/authelia, github.com/authelia/authelia/v4 · fixed in 4.39.20
- CVE-2026-48089DevGuard has improper authorization on public assetsGo · github.com/l3montree-dev/devguard · fixed in 1.4.2
- CVE-2026-49340gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the hostGo · go.senan.xyz/gonic · fixed in 0.21.0
- CVE-2026-49338Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR)Go · go.senan.xyz/gonic · fixed in 0.21.0
- CVE-2026-27878Tempo TraceQL query with exemplar hint could result in unbounded memory usageGo · github.com/grafana/tempo · fixed in 1.5.1-0.20260303204923-b13f74291d48
- CVE-2026-49339Path traversal in getPlaylist/deletePlaylist bypasses ownership check: any authenticated user can read or delete any other user's playlistGo · go.senan.xyz/gonic · fixed in 0.21.0
- CVE-2026-44939Command injection through unsanitized YAML parameter in RancherGo · github.com/rancher/rancher · fixed in 2.14.2, 2.13.6, 2.12.10 and more
- CVE-2026-10720MicroCeph path traversal issue in the remote-import APIGo · github.com/canonical/microceph/microceph · fixed in 0.0.0-20260609072127-5c2760d8fb76
- CVE-2026-50141Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonationGo · go.woodpecker-ci.org/woodpecker, go.woodpecker-ci.org/woodpecker/v2 +1 · fixed in 3.14.1
- CVE-2026-11719An authenticated authorization bypass vulnerability exists in MCP Toolbox for Databases due to missing scope enforcement across older protocGo · github.com/googleapis/mcp-toolbox · fixed in 1.4.0
- CVE-2026-11718An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox.Go · github.com/googleapis/mcp-toolbox · fixed in 1.4.0
- CVE-2026-11717An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox.Go · github.com/googleapis/mcp-toolbox · fixed in 1.4.0
- CVE-2026-48788Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofingGo · github.com/umputun/remark42 · fixed in 1.16.0
- CVE-2026-48777FileBrowser Quantum: Path Traversal in public share PATCH allows file ops outside shared directoryGo · github.com/gtsteffaniak/filebrowser/backend · fixed in 0.0.0-20260518193514-28e9b81e438e
- CVE-2025-71261Harvester's SUSE Virtualization Registration Client Vulnerable to MITM and DOSGo · github.com/harvester/harvester · fixed in 1.8.0
- CVE-2026-48709OliveTin: ValidateArgumentType API Endpoint Missing Authentication Allows Action and Argument EnumerationGo · github.com/olivetin/olivetin · fixed in 0.0.0-20260521230847-a3865704c854
- CVE-2026-48708OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command ContaminationGo · github.com/olivetin/olivetin · fixed in 0.0.0-20260521225117-d74da9314005
- CVE-2026-50879An issue in the uploadPostHandler component of Andrei Marcu linx-server v2.3.8 allows attackers to cause a Denial of Service (DoS) via a craGo · github.com/andreimarcu/linx-server
- CVE-2026-50884Incorrect access control in statping-ng v0.93.0 allows attackers to escalate privileges to Administrator and access sensitive components.Go · github.com/statping-ng/statping-ng
- CVE-2026-50891Incorrect access control in the /admin/api/config component of Filestash v0.4.0 allows attackers to escalate privileges via sending a crafteGo · github.com/mickael-kerjean/filestash
- CVE-2026-11624The Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DNGo · github.com/googleapis/genai-toolbox, github.com/googleapis/mcp-toolbox · fixed in 0.25.0
- CVE-2026-11769Operator - Namespaced User Path TraversalGo · github.com/grafana/grafana-operator, github.com/grafana/grafana-operator/v3 +2 · fixed in 5.24.0
- CVE-2026-53523Nezha Monitoring: OAuth2 Redirect URL — Host Header InjectionGo · github.com/nezhahq/nezha · fixed in 2.2.0
- CVE-2026-53522Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoSGo · github.com/nezhahq/nezha · fixed in 2.2.0
- CVE-2026-53521Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile contextGo · github.com/nezhahq/nezha · fixed in 2.1.0