Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-53520Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routingGo · github.com/nezhahq/nezha · fixed in 2.1.0
- CVE-2026-53519Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_keyGo · github.com/nezhahq/nezha · fixed in 2.0.13
- CVE-2026-49397Nezha Monitoring: Private services (`EnableShowInService: false`) are enumerable via per-server endpoints, leaking name and timing dataGo · github.com/nezhahq/nezha · fixed in 2.0.14
- CVE-2026-49396Nezha Monitoring: Cross-site GET request can trigger stored cron commands on a victim's agentsGo · github.com/nezhahq/nezha · fixed in 2.0.14
- CVE-2026-48119Nezha Monitoring: Authenticated agents can forge service-monitor results for other users' servicesGo · github.com/naiba/nezha, github.com/nezhahq/nezha · fixed in 1.14.15-0.20260521020202-02129f16fb15, 2.0.12
- CVE-2026-47124Nezha WebSocket server stream discloses cross-tenant server telemetry to authenticated membersGo · github.com/nezhahq/nezha · fixed in 1.14.15-0.20260517034128-05e5da253519
- CVE-2026-47120Nezha Monitoring: RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check)Go · github.com/nezhahq/nezha · fixed in 1.14.15-0.20260517022419-d7526351cf97
- CVE-2026-46717Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notificationGo · github.com/nezhahq/nezha · fixed in 1.14.15-0.20260517022419-d06d539d34c1
- CVE-2026-46716Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cronGo · github.com/nezhahq/nezha · fixed in 1.14.15-0.20260517022419-d7526351cf97
- CVE-2026-47268Nezha Monitoring: Authenticated DDNS webhook configuration allows blind SSRF from the dashboard hostGo · github.com/naiba/nezha, github.com/nezhahq/nezha · fixed in 2.0.10
- CVE-2026-42306Moby: Race condition in docker cp allows bind mount redirection to host pathGo · github.com/docker/docker, github.com/moby/moby +1 · fixed in 2.0.0-beta.14
- CVE-2026-41568Moby: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swapGo · github.com/docker/docker, github.com/moby/moby +1 · fixed in 2.0.0-beta.14
- CVE-2026-6961CVE-2026-6961: Path traversal via unsanitized FileInfo.Name in Mattermost federation syncGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.17+incompatible, 11.5.5+incompatible, 11.6.1+incompatible and more
- CVE-2026-7387Mattermost group syncable endpoints allow privilege escalation via scheme_adminGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 11.6.1, 11.5.5, 10.11.17 and more
- CVE-2026-6046Plugin bot username conflict allows user account to be used as bot identity in Mattermost ServerGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.17+incompatible, 11.5.5+incompatible, 11.6.1+incompatible and more
- CVE-2026-6689*Missing* {{invite_user}} *permission check on team creation allows unprivileged users to set open-invite and allowed-domains team settings*Go · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.17+incompatible, 11.5.5+incompatible, 11.6.1+incompatible and more
- CVE-2026-7184Mattermost Remote Cluster PATCH API Leaks Authentication TokensGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.16+incompatible, 11.5.5+incompatible, 11.6.1+incompatible and more
- CVE-2026-6739Mattermost: Delegated admins could patch protected default system rolesGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 11.6.1, 11.5.5, 10.11.17 and more
- CVE-2026-3433Mattermost fails to scope role_updated websocket events to authorized team and channel membersGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.17+incompatible, 11.5.5+incompatible, 11.6.1+incompatible and more
- CVE-2026-47190IPAM controller service account granted unnecessary full access to SecretsGo · github.com/metal3-io/ip-address-manager · fixed in 1.11.7, 1.12.4
- CVE-2026-46695BoxLite: Permission Bypass in boxlite Allows Modification of Read-Only FilesGo · github.com/boxlite-ai/boxlite/sdks/go · fixed in 0.9.0
- CVE-2026-46703BoxLite: Path Traversal Vulnerability in boxlite Leads to Arbitrary File Write on the HostGo · github.com/boxlite-ai/boxlite/sdks/go · fixed in 0.9.0
- CVE-2026-46668SpiceDB: Caveat structures with nested lists can result in improper cache reuseGo · github.com/authzed/spicedb · fixed in 1.52.0
- CVE-2026-45062FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP FilesGo · github.com/dunglas/frankenphp · fixed in 1.12.3
- CVE-2026-50570Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruptionGo · github.com/fission/fission · fixed in 1.25.0
- CVE-2026-50569Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checksGo · github.com/fission/fission · fixed in 1.25.0
- CVE-2026-50568Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escapeGo · github.com/fission/fission · fixed in 1.25.0
- CVE-2026-50567Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directoryGo · github.com/fission/fission · fixed in 1.25.0
- CVE-2026-50566Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creationGo · github.com/fission/fission · fixed in 1.24.0
- CVE-2026-50565Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder containerGo · github.com/fission/fission · fixed in 1.24.0