Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-44697Klever-Go MultiDataInterceptor: remote OOM via crafted compressed P2P payloadGo · github.com/klever-io/klever-go
- CVE-2026-45625Arcane: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configsGo · github.com/getarcaneapp/arcane/backend · fixed in 1.19.0
- CVE-2026-45626Arcane: OS Command Injection in Volume Browser ListDirectory via path query parameterGo · github.com/getarcaneapp/arcane/backend
- CVE-2026-45627Arcane: Unauthenticated reflected XSS via SVG color parameter in /api/app-images/logo enables admin account takeoverGo · github.com/getarcaneapp/arcane/backend · fixed in 1.19.0
- CVE-2026-47125Arcane: Missing admin authorization on global variables endpointGo · github.com/getarcaneapp/arcane/backend · fixed in 1.19.2
- CVE-2026-47179Arcane: Authenticated Arbitrary Host File Read via Docker Compose Include Directives in ArcaneGo · github.com/getarcaneapp/arcane/backend · fixed in 1.19.4
- CVE-2026-48501GitHub CLI tokens leak via `gh attestation` commandsGo · github.com/cli/cli, github.com/cli/cli/v2 · fixed in 2.93.0
- CVE-2026-44973Billy: Path traversal vulnerabilitiesGo · github.com/go-git/go-billy/v5, github.com/go-git/go-billy/v6 · fixed in 5.9.0, 6.0.0-alpha.1
- CVE-2026-44881Portainer: Arbitrary File Read via Git Symlink Injection in Stack Auto-UpdateGo · github.com/portainer/portainer · fixed in 2.33.8, 2.39.2, 2.41.0
- CVE-2026-44848Portainer: Missing authorization on Docker plugin endpoints allows host RCEGo · github.com/portainer/portainer · fixed in 2.33.8, 2.39.2, 2.41.0
- CVE-2026-44849Portainer: Endpoint security bypass via Swarm service create/updateGo · github.com/portainer/portainer · fixed in 2.33.8, 2.39.2, 2.41.0
- CVE-2026-44850Portainer: Bind-mount restriction bypass via HostConfig.MountsGo · github.com/portainer/portainer · fixed in 2.33.8, 2.39.2, 2.41.0
- CVE-2026-44882Portainer: Kubernetes middleware continues after token validation failure, bypassing endpoint authorizationGo · github.com/portainer/portainer · fixed in 2.33.8
- CVE-2026-44883Portainer: JWT accepted in URL query leaks tokens to logs and referersGo · github.com/portainer/portainer · fixed in 2.33.8, 2.39.2, 2.41.0
- CVE-2026-44884Portainer: Missing authorization on custom template file endpoint exposes template contentGo · github.com/portainer/portainer · fixed in 2.33.8, 2.39.1
- CVE-2026-44885Portainer: Path traversal in backup archive extraction allows arbitrary file writeGo · github.com/portainer/portainer · fixed in 2.33.8
- CVE-2026-45021Kuma: Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdminGo · github.com/kumahq/kuma, github.com/kumahq/kuma/v2 · fixed in 2.7.25, 2.9.15, 2.11.13 and more
- CVE-2026-44543Local Path Provisioner: HelperPod Template InjectionGo · github.com/rancher/local-path-provisioner · fixed in 0.0.36
- CVE-2026-9098CVE-2026-9098Go · github.com/casdoor/casdoor
- CVE-2026-9097CVE-2026-9097Go · github.com/casdoor/casdoor
- CVE-2026-9096CVE-2026-9096Go · github.com/casdoor/casdoor
- CVE-2026-9094CVE-2026-9094Go · github.com/casdoor/casdoor · fixed in 2.387.0
- CVE-2026-9093CVE-2026-9093Go · github.com/casdoor/casdoor
- CVE-2026-9091CVE-2026-9091Go · github.com/casdoor/casdoor
- CVE-2026-9090CVE-2026-9090Go · github.com/casdoor/casdoor
- CVE-2026-41185ServiceAccount token disclosure via Azure IPAM CNI plugin logsGo · github.com/projectcalico/calico, github.com/projectcalico/calico/v3 · fixed in 3.31.6, 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f
- CVE-2026-6720Calicoctl leaks cluster credentials to stderr when verbose logging is enabledGo · github.com/projectcalico/calicoctl, github.com/projectcalico/calicoctl/v3 · fixed in 3.31.6
- CVE-2026-41184ServiceAccount token disclosure via install-cni container logsGo · github.com/projectcalico/calico, github.com/projectcalico/calico/v3 · fixed in 3.31.6, 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f
- CVE-2026-44477CloudNativePG: Metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCEGo · github.com/cloudnative-pg/cloudnative-pg · fixed in 1.28.3, 1.29.1
- CVE-2026-44594esm.sh: Path Traversal via package.json browser field allows reading arbitrary server filesGo · github.com/esm-dev/esm.sh · fixed in 0.0.0-20250616164159-0593516c4cfa