Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-45327TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injectionGo · github.com/datanoisetv/tinyice · fixed in 2.5.0
- CVE-2026-41567Docker: `PUT /containers/{id}/archive` executes container binary on the hostGo · github.com/docker/docker, github.com/moby/moby +1 · fixed in 2.0.0-beta.14
- CVE-2026-40898quic-go: HTTP/3 QPACK Trailer Expansion Memory ExhaustionGo · github.com/quic-go/quic-go · fixed in 0.59.1
- CVE-2026-10814milvus-io milvus Grantee ID Hash kv_catalog.go weak hashGo · github.com/milvus-io/milvus · fixed in 0.10.3-0.20260602041816-3d932f1c3e06
- CVE-2026-45287OpenTelemetry-Go's Schema ParseFile leaks file descriptors on each parseGo · go.opentelemetry.io/otel/schema, go.opentelemetry.io/otel/schema/v1.0 +1 · fixed in 0.0.17
- CVE-2026-41178OpenTelemetry-Go's baggage parsing no longer caps raw header lengthGo · go.opentelemetry.io/otel, go.opentelemetry.io/otel/baggage +1 · fixed in 1.42.0, 1.44.0
- CVE-2026-10722cilium ebpf LoadCollectionSpec/LoadCollectionSpecFromReader btf.go loadRawSpec integer overflowGo · github.com/cilium/ebpf · fixed in 0.22.0
- CVE-2026-37462An integer underflow in the BGPUpdate.DecodeFromBytes function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (Go · github.com/osrg/gobgp/v4 · fixed in 4.4.0
- CVE-2026-42507Arbitrary inputs are included in errors without any escaping in net/textprotoGo · stdlib · fixed in 1.25.11, 1.26.4
- CVE-2026-42504Quadratic complexity in WordDecoder.DecodeHeader in mimeGo · mime · fixed in 1.25.11, 1.26.4
- CVE-2026-27145Inefficient candidate hostname parsing in crypto/x509Go · stdlib · fixed in 1.25.11, 1.26.4
- CVE-2026-47201authentik: XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated userGo · goauthentik.io · fixed in 0.0.0-20260528144335-a370d76d23c7
- CVE-2026-45686OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBIGo · go.opentelemetry.io/obi · fixed in 0.9.0
- CVE-2026-45685OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messagesGo · go.opentelemetry.io/obi · fixed in 0.9.0
- CVE-2026-45684OpenTelemetry eBPF Instrumentation: Log enricher writev path can overread and overwrite user buffersGo · go.opentelemetry.io/obi · fixed in 0.9.0
- CVE-2026-45683OpenTelemetry eBPF Instrumentation: Java TLS ioctl kprobe allows kernel memory disclosureGo · go.opentelemetry.io/obi · fixed in 0.9.0
- CVE-2026-45681OpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB sizeGo · go.opentelemetry.io/obi · fixed in 0.9.0
- CVE-2026-45680OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPUGo · go.opentelemetry.io/obi · fixed in 0.9.0
- CVE-2026-45679OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messagesGo · go.opentelemetry.io/obi · fixed in 0.9.0
- CVE-2026-45678OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloadsGo · go.opentelemetry.io/obi · fixed in 0.9.0
- CVE-2026-45676OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agentGo · go.opentelemetry.io/obi · fixed in 0.9.0
- CVE-2026-45682OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removalsGo · go.opentelemetry.io/obi · fixed in 0.9.0
- CVE-2026-30963Capsule Namespace Hijacking via subresourceGo · github.com/projectcapsule/capsule · fixed in 0.13.0
- CVE-2026-22872Capsule TenantResource RawItems Cluster-Scoped Resource Creation VulnerabilityGo · github.com/projectcapsule/capsule · fixed in 0.13.0
- CVE-2026-44740go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustionGo · github.com/go-git/go-billy/v5, github.com/go-git/go-billy/v6 · fixed in 5.9.0, 6.0.0-alpha.1
- CVE-2026-10219nextlevelbuilder GoClaw write_file Tool fsbridge.go FsBridge.WriteFile os command injectionGo · github.com/nextlevelbuilder/goclaw
- CVE-2026-46385iskorotkov/avro: CPU Exhaustion in Avro DecoderGo · github.com/hamba/avro/v2, github.com/iskorotkov/avro/v2 · fixed in 2.33.0
- CVE-2026-46384iskorotkov/avro: Integer Overflow in Avro DecoderGo · github.com/hamba/avro/v2, github.com/iskorotkov/avro/v2 · fixed in 2.33.0
- CVE-2026-46599Excessive resource consumption in PackBits decompression in golang.org/x/image/tiffGo · golang.org/x/image · fixed in 0.41.0
- CVE-2026-42500Panic when reading out of bound palette index in golang.org/x/image/bmpGo · golang.org/x/image · fixed in 0.41.0