Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-50564Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escapeGo · github.com/fission/fission · fixed in 1.24.0
- CVE-2026-50563Fission Container Executor Function PodSpec Injection Leading to Node EscapeGo · github.com/fission/fission · fixed in 1.24.0
- CVE-2026-50545Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster TakeoverGo · github.com/fission/fission · fixed in 1.24.0
- CVE-2026-49824Fission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhookGo · github.com/fission/fission · fixed in 1.24.0
- CVE-2026-49823Fission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhookGo · github.com/fission/fission · fixed in 1.24.0
- CVE-2026-49822Fission: Cross-namespace event leakage via KubernetesWatchTrigger allows persistent tenant surveillanceGo · github.com/fission/fission · fixed in 1.24.0
- CVE-2026-49821Fission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltrationGo · github.com/fission/fission · fixed in 1.24.0
- CVE-2026-46618Fission builder accepts arbitrary buildcmd strings from Environment.spec.builder.command, allowing the builder pod to invoke arbitrary executablesGo · github.com/fission/fission · fixed in 1.23.0
- CVE-2026-46617Fission runtime pods automount the fission-fetcher service-account token into the user function container, granting function code namespace-wide secret / configmap readGo · github.com/fission/fission · fixed in 1.23.0
- CVE-2026-46612Fission StorageSvc /v1/archive endpoint exposes unauthenticated CRUD over all function archivesGo · github.com/fission/fission · fixed in 1.23.0
- CVE-2026-46614Fission router exposes /fission-function/<ns>/<name> on its public listener, allowing invocation of any function without an HTTPTriggerGo · github.com/fission/fission · fixed in 1.23.0
- CVE-2026-48096OpenFGA: Cache-key delimiter injection in openfga/openfga shared-iterator and v2 iterator caches enables intra-store authorization-decision poisoningGo · github.com/openfga/openfga · fixed in 1.16.0
- CVE-2026-25700Apache Answer: AdminToken not invalidated after admin deactivationGo · github.com/apache/answer, github.com/apache/incubator-answer · fixed in 2.0.1
- CVE-2026-53470Migration-planner: getsourcedownloadurl missing organization checkGo · github.com/kubev2v/migration-planner · fixed in 0.13.5
- CVE-2026-53476Assisted-migration-agent: vddk tarball chained-symlink arbitrary file writeGo · github.com/kubev2v/assisted-migration-agent · fixed in 0.16.0
- CVE-2026-53475Assisted-migration-agent: tls verification disabled on all vcenter connectionsGo · github.com/kubev2v/assisted-migration-agent · fixed in 0.16.0
- CVE-2026-53471Migration-planner: agent api ignores jwt source_id claimGo · github.com/kubev2v/migration-planner · fixed in 0.13.5
- CVE-2026-53474Migration-planner: second-order sql injection via rvtools uploadGo · github.com/kubev2v/migration-planner · fixed in 0.13.5
- CVE-2026-53469Migration-planner: unprotected delete endpoint wipes all tenant dataGo · github.com/kubev2v/migration-planner · fixed in 0.13.5
- CVE-2026-34905Apache Answer: Unlisted Questions Accessible via Direct API AccessGo · github.com/apache/answer, github.com/apache/incubator-answer · fixed in 1.7.2-0.20260509071350-11c80384f13a
- CVE-2026-34033Apache Answer: HTML Content Injection in EmailGo · github.com/apache/answer, github.com/apache/incubator-answer · fixed in 1.7.2-0.20260509080709-d1a4092c61cc
- CVE-2026-34031Apache Answer: The custom avatar was not properly validatedGo · github.com/apache/answer, github.com/apache/incubator-answer · fixed in 1.7.2-0.20260511040518-11091244f64e
- CVE-2026-33582Apache Answer: Uploading specially crafted TIFF files causes an Out-of-Memory errorGo · github.com/apache/answer, github.com/apache/incubator-answer · fixed in 1.7.2-0.20260325113131-cfc3e54f30cc
- CVE-2026-25699Apache Answer: Authorization Bypass in Timeline APIGo · github.com/apache/answer, github.com/apache/incubator-answer · fixed in 1.7.2-0.20260206073245-92994b49976b
- CVE-2026-25688Apache Answer: XSS in AI Answer RenderingGo · github.com/apache/answer, github.com/apache/incubator-answer · fixed in 1.7.2-0.20260525024654-2746bf5b455f
- CVE-2026-11500Weaviate Static API Key client.go validateConfig authorizationGo · github.com/weaviate/weaviate · fixed in 1.38.0-rc.0
- CVE-2026-11481yoanbernabeu grepai Postgres Embedding Cache chunker.go PostgresStore.LookupByContentHash weak hashGo · github.com/yoanbernabeu/grepai
- CVE-2026-11479yoanbernabeu grepai Qdrant Backend chunker.go weak hashGo · github.com/yoanbernabeu/grepai
- CVE-2026-11465songquanpeng one-api Redemption Code Top-Up Endpoint redemption.go Redeem logic errorGo · github.com/songquanpeng/one-api
- CVE-2026-11401Privilege Escalation in AWS Advanced Go Wrapper for Amazon Aurora PostgreSQLGo · github.com/aws/aws-advanced-go-wrapper/auth-helpers, github.com/aws/aws-advanced-go-wrapper/aws-secrets-manager +10 · fixed in 1.1.1, 1.1.2, 2.0.1 and more