Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-42506Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/htmlGo · golang.org/x/net · fixed in 0.55.0
- CVE-2026-4635Persistent notification timing attack causing server denial of serviceGo · github.com/mattermost/mattermost-server · fixed in 10.11.15+incompatible, 11.4.5+incompatible, 11.5.4+incompatible and more
- CVE-2026-3473Improper file ownership validation in the Boards API allows unauthorised file accessGo · github.com/mattermost/mattermost-server · fixed in 11.6.1, 11.5.4, 11.4.5 and more
- CVE-2026-4646Insufficient input validation in GitHub plugin API causes denial of serviceGo · github.com/mattermost/mattermost-plugin-github, github.com/mattermost/mattermost-server · fixed in 1.0.1-0.20260330164815-c2840e980b3c, 11.6.1, 11.5.4 and more
- CVE-2026-3636Sanitize team member data returned by APIGo · github.com/mattermost/mattermost-server · fixed in 10.11.15+incompatible, 11.4.5+incompatible, 11.5.4+incompatible and more
- CVE-2026-5740Unauthenticated WebSocket binary frame causes denial of service in Mattermost ServerGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 11.6.1, 11.5.4, 11.4.5 and more
- CVE-2026-5308Missing request body size limits on Zoom plugin HTTP endpointsGo · github.com/mattermost/mattermost-plugin-github, github.com/mattermost/mattermost-server · fixed in 1.0.1-0.20260410143745-9b41b1fd43c4, 11.6.1, 11.5.4 and more
- CVE-2026-5755Denial of service via crafted TIFF file uploadGo · github.com/mattermost/mattermost-server · fixed in 11.6.1, 11.5.4, 11.4.5 and more
- CVE-2026-46598Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agentGo · golang.org/x/crypto · fixed in 0.52.0
- CVE-2026-46595Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/sshGo · golang.org/x/crypto · fixed in 0.52.0
- CVE-2026-42508Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhostsGo · golang.org/x/crypto · fixed in 0.52.0
- CVE-2026-39834Invoking infinite loop on large channel writes in golang.org/x/crypto/sshGo · golang.org/x/crypto · fixed in 0.52.0
- CVE-2026-39831Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/sshGo · golang.org/x/crypto · fixed in 0.52.0
- CVE-2026-39829Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/sshGo · golang.org/x/crypto · fixed in 0.52.0
- CVE-2026-39830Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/sshGo · golang.org/x/crypto · fixed in 0.52.0
- CVE-2026-39827Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/sshGo · golang.org/x/crypto · fixed in 0.52.0
- CVE-2026-39835Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/sshGo · golang.org/x/crypto · fixed in 0.52.0
- CVE-2026-39828Invoking bypass of certificate restrictions in golang.org/x/crypto/sshGo · golang.org/x/crypto · fixed in 0.52.0
- CVE-2026-46597Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/sshGo · golang.org/x/crypto · fixed in 0.52.0
- CVE-2026-39832Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agentGo · golang.org/x/crypto · fixed in 0.52.0
- CVE-2026-39833Invoking key constraints not enforced in golang.org/x/crypto/ssh/agentGo · golang.org/x/crypto · fixed in 0.52.0
- CVE-2026-45760Apache Camel K: Camel K Cross-Namespace Build Deputy AttackGo · github.com/apache/camel-k, github.com/apache/camel-k/v2 · fixed in 2.8.1, 2.9.2, 2.10.1
- CVE-2026-4858Path traversal in integration action URL leading to arbitrary API execution via system admin’s auth token.Go · github.com/mattermost/mattermost-server · fixed in 11.6.1, 11.5.4, 11.4.5 and more
- CVE-2026-4055Insufficient permission validation on cross-team playbook run creationGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 8.0.0-20260320113102-f2b3d1c6a945
- CVE-2025-70950An issue in gohttp commit 34ea51 allows attackers to execute a directory traversal via supplying a crafted request.Go · github.com/itang/gohttp
- CVE-2026-6333SSRF via Host Header Spoofing in Custom Slash CommandsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 5.3.2-0.20260325160634-e738016c5920, 10.11.14+incompatible, 11.5.2+incompatible and more
- CVE-2026-6345Prevent password disclosure and force reset during Slack importGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.14+incompatible, 11.4.4+incompatible, 11.5.2+incompatible and more
- CVE-2026-6346Sensitive credentials exposed in plaintext in Mattermost support packetsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.14+incompatible, 11.4.4+incompatible, 11.5.2+incompatible and more
- CVE-2026-28732Slash command trigger-word update allowed command hijackingGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 5.3.2-0.20260306123948-f5fe8ded6b63, 10.11.14+incompatible, 11.4.4+incompatible and more
- CVE-2026-6343Mattermost Playbooks Plugin fails to enforce view permissions in list endpoints, allowing unauthorized access to public playbooksGo · github.com/mattermost/mattermost-plugin-playbooks, github.com/mattermost/mattermost-server +3 · fixed in 1.41.1-0.20260309184833-887d9cacb616, 10.11.14+incompatible, 11.4.4+incompatible and more