Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-44330free5GC: NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptionsGo · github.com/free5gc/nef
- CVE-2026-44318free5GC: BSF concurrent PUT /nbsf-management/v1/subscriptions/{subId} crashes the BSF process via concurrent map read/write on SubscriptionsGo · github.com/free5gc/bsf · fixed in 1.0.2
- CVE-2026-44473Ella Core: UE Downlink Redirection via Forged PDUSessionResourceSetupResponseGo · github.com/ellanetworks/core · fixed in 1.10.0
- CVE-2026-44475Ella Core: UE Security Capability bypass on NGAP PathSwitchRequestGo · github.com/ellanetworks/core · fixed in 1.10.0
- CVE-2026-44474Ella Core: Handover failures during concurrent Security Mode CommandGo · github.com/ellanetworks/core · fixed in 1.10.0
- CVE-2026-45570go-git: Improper single-quote escaping in go-git SSH transportGo · github.com/go-git/go-git, github.com/go-git/go-git/v5 +1 · fixed in 5.19.1, 6.0.0-alpha.4
- CVE-2026-45571go-git: Crafted repositories may modify main and submodule .git directoriesGo · github.com/go-git/go-git, github.com/go-git/go-git/v5 +1 · fixed in 5.19.1, 6.0.0-alpha.4
- CVE-2026-45022go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream GitGo · github.com/go-git/go-git/v5, github.com/go-git/go-git/v6 · fixed in 5.19.0, 6.0.0-alpha.3
- CVE-2026-36045picoclaw <=v0.1.2 and earlier is vulnerable to OS command injection via the ExecTool component (pkg/tools/shell.go).Go · github.com/sipeed/picoclaw
- CVE-2026-45298Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)Go · github.com/amir20/dozzle
- CVE-2026-44985Dozzle: Cross-Site WebSocket Hijacking (CSWSH) on exec/attach endpoints bypasses authenticationGo · github.com/amir20/dozzle
- CVE-2026-44903Prometheus: Stored XSS via crafted histogram bucket label values in the heatmap display of the old Prometheus web UIGo · github.com/prometheus/prometheus · fixed in 0.311.3
- CVE-2026-41164nuts-node: JWT type confusion in v1 access token introspection allows VP replay as access tokenGo · github.com/nuts-foundation/nuts-node
- CVE-2026-48126Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dirGo · github.com/xyproto/algernon · fixed in 1.17.8
- CVE-2026-46431Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: *Go · github.com/xyproto/algernon · fixed in 1.17.7
- CVE-2026-46430Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOSGo · github.com/xyproto/algernon · fixed in 1.17.7
- CVE-2026-45728Algernon: Single-file mode unconditionally enables debug modeGo · github.com/xyproto/algernon · fixed in 1.17.7
- CVE-2026-45721Algernon: handler.lua discovery walks parent directories above the server rootGo · github.com/xyproto/algernon · fixed in 1.17.7
- CVE-2026-7374Kubevirt: kubevirt virt-handler: privilege escalation and node compromise via symlink following vulnerabilityGo · kubevirt.io/kubevirt · fixed in 1.6.6, 1.7.4, 1.8.3
- CVE-2026-4915Server panic via outgoing webhook responsesGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 11.6.1, 11.5.4, 11.4.5 and more
- CVE-2026-9301omec-project amf NGReset Message memory corruptionGo · github.com/omec-project/amf · fixed in 1.7.1-0.20260421213846-34bc6724acc9
- CVE-2026-9300omec-project amf NGSetupRequest memory corruptionGo · github.com/omec-project/amf · fixed in 1.7.1-0.20260421213846-34bc6724acc9
- CVE-2026-9299omec-project amf handler.go PDUSessionResourceModifyIndication memory corruptionGo · github.com/omec-project/amf · fixed in 1.7.1-0.20260421213846-34bc6724acc9
- CVE-2026-39824Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windowsGo · golang.org/x/sys · fixed in 0.44.0
- CVE-2026-28735GitHub OAuth Scope ValidationGo · github.com/mattermost/mattermost-plugin-github, github.com/mattermost/mattermost-server · fixed in 1.0.1-0.20260318132218-6e6b740c4852, 11.6.1, 11.5.4 and more
- CVE-2026-27136Invoking duplicate attributes can cause XSS in golang.org/x/net/htmlGo · golang.org/x/net · fixed in 0.55.0
- CVE-2026-25681Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/htmlGo · golang.org/x/net · fixed in 0.55.0
- CVE-2026-25680Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/htmlGo · golang.org/x/net · fixed in 0.55.0
- CVE-2026-42502Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/htmlGo · golang.org/x/net · fixed in 0.55.0
- CVE-2026-39821Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idnaGo · golang.org/x/net, stdlib · fixed in 0.55.0, 1.25.13, 1.26.6 and more