Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-54462knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustionGo · knative.dev/pkg · fixed in 0.0.0-20260531000007-52dbd5ece63f
- CVE-2026-116591compress zstd: Panic on two-block framesGo · github.com/klauspost/compress, github.com/klauspost/compress/zstd · fixed in 1.20.2
- CVE-2026-116587Go JOSE: DoS when parsing JWKs that contain RSA keysGo · github.com/go-jose/go-jose/v3, github.com/go-jose/go-jose/v4 · fixed in 4.1.6
- CVE-2026-116586Go JOSE: Panics in JSON parsingGo · github.com/go-jose/go-jose/v3, github.com/go-jose/go-jose/v4 · fixed in 4.1.5
- CVE-2026-116585Go JOSE: Panic during CBC-HMAC processingGo · github.com/go-jose/go-jose/v3, github.com/go-jose/go-jose/v4 · fixed in 4.1.5
- CVE-2026-57208Entire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewindGo · github.com/entireio/cli · fixed in 0.7.7
- CVE-2026-57210Heimdall: IP Spoofing via Unvalidated Forwarding HeadersGo · github.com/dadrus/heimdall, https://github.com/dadrus/heimdall · fixed in 0.17.17
- CVE-2026-57209Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy ModeGo · github.com/dadrus/heimdall · fixed in 0.17.17
- CVE-2022-51026Bytebase 0.12.0 before 1.0.1 Authentication Bypass via GitLab Self-Hosted LoginGo · github.com/bytebase/bytebase · fixed in 1.0.1
- CVE-2026-111497Out-of-Bounds Write in Google Brotli DecoderGo · github.com/andybalholm/brotli · fixed in 1.2.7
- CVE-2026-114665Goploy 1.18.0 before 1.18.1 Symlink Following Arbitrary File Read via /deploy/fileDiff and /deploy/fileCompareGo · github.com/zhenorzz/goploy · fixed in 1.18.0
- CVE-2026-114437Chi Client IP Spoofing in ClientIPFromXFF via X-Forwarded-ForGo · github.com/go-chi/chi/v5 · fixed in 5.4.0
- CVE-2026-111943Distrust compromised intermediate certificates in crypto/x509Go · crypto/x509, stdlib · fixed in 1.26.10, 1.27.3
- CVE-2026-114101Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule BypassGo · github.com/corazawaf/coraza, github.com/corazawaf/coraza/v2 +1 · fixed in 3.8.1
- CVE-2026-114100Coraza from 3.0.4 before 3.8.1 Request Body Inspection Bypass via Content-TypeGo · github.com/corazawaf/coraza, github.com/corazawaf/coraza/v2 +1 · fixed in 3.8.1
- CVE-2026-114099Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key CollisionGo · github.com/corazawaf/coraza, github.com/corazawaf/coraza/v2 +1 · fixed in 3.8.1
- CVE-2026-113729Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalizationGo · github.com/moov-io/signedxml · fixed in 1.4.1
- CVE-2026-113727OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runsGo · github.com/openchoreo/openchoreo · fixed in 1.0.6, 1.1.7, 1.2.5
- GO-2026-6651Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks in github.com/xtls/xray-coreGo · github.com/xtls/xray-core · fixed in 1.260327.1-0.20260710210335-64fada32b5b9
- CVE-2026-111933Coder before 2.34.2 User Enumeration via Login Placeholder HashGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.34.2, 2.33.8, 2.32.7 and more
- CVE-2026-111932Coder before 2.34.2 Stored HTML Injection via Appearance SettingsGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.34.2, 2.33.8, 2.32.7 and more
- CVE-2026-111922Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost OriginsGo · code.vikunja.io/api
- CVE-2026-111921Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share DeletionGo · code.vikunja.io/api · fixed in 2.7.0
- CVE-2026-111920Vikunja 2.6.0 Broken Access Control via Inherited Project PermissionsGo · code.vikunja.io/api
- CVE-2026-111919Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via WebhooksGo · code.vikunja.io/api
- CVE-2026-111918Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter CreationGo · code.vikunja.io/api · fixed in 2.7.0
- CVE-2026-111917Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session RevocationGo · code.vikunja.io/api
- CVE-2025-71435Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh TokenGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.23.0
- CVE-2024-58398Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect ParameterGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.16.1, 2.15.3, 2.14.4
- CVE-2026-96627Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)Go · github.com/getarcaneapp/arcane/backend, github.com/getarcaneapp/arcane/backend/v2 · fixed in 2.6.0