Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-6347Mattermost Calls plugin exposes TURN server credentials in plaintext in support packetsGo · github.com/mattermost/mattermost-plugin-calls, github.com/mattermost/mattermost-server · fixed in 1.12.0-rc2, 11.5.2, 10.11.14 and more
- CVE-2026-5163Missing authorization check in AI message rewrite endpoint allows access to private thread contentGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 11.5.2+incompatible, 5.3.2-0.20260401090745-f4d1abe7e8f5, 8.0.0-20260401090745-f4d1abe7e8f5 and more
- CVE-2026-4286Playbooks Plugin fails to validate team transfers, allowing unauthorized removal of member access via playbook updateGo · github.com/mattermost/mattermost-plugin-playbooks, github.com/mattermost/mattermost-server +3 · fixed in 1.41.1-0.20260213020129-e1d6ec2c94e6, 10.11.14+incompatible, 11.5.2+incompatible and more
- CVE-2026-6339Missing request origin validation on burn-on-read reveal endpointGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 5.3.2-0.20260327001745-7a339a6438f5, 11.4.4+incompatible, 11.5.2+incompatible and more
- CVE-2026-6340Memory Exhaustion via Malicious 7zip File UploadGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 5.3.2-0.20260325191733-fb11968f8798, 10.11.14+incompatible, 11.4.4+incompatible and more
- CVE-2026-3495Unescaped variables during error page compositionGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.14+incompatible, 11.5.2+incompatible, 5.3.2-0.20260310115442-5a1ea95044dc and more
- CVE-2026-4273Insufficient token rotation validation in remote cluster invite confirmationGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.14+incompatible, 11.5.2+incompatible, 5.3.2-0.20260313190740-742e0be95074 and more
- CVE-2026-3637Mattermost fails to enforce create_post permission when editing postsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 5.3.2-0.20260316171743-090408f09f53, 10.11.14+incompatible, 11.4.4+incompatible and more
- CVE-2026-2325Improper Input Validation in MS Teams Meetings API HandlerGo · github.com/mattermost/mattermost-plugin-msteams-meetings, github.com/mattermost/mattermost-server · fixed in 1.1.1-0.20260213105619-c5892dd169de, 11.5.2, 10.11.14 and more
- CVE-2026-28759Insufficient authorization in shared channel membership sync allows remote cluster to remove users from arbitrary channelsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 5.3.2-0.20260216150504-8738f8c4b3d4, 10.11.14+incompatible, 11.4.4+incompatible and more
- CVE-2026-6334OAuth authorization code client binding not enforced during token redemption in MattermostGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 5.3.2-0.20260318173148-e9ae890a013b, 10.11.14+incompatible, 11.5.2+incompatible and more
- CVE-2026-8783omec-project amf dispatcher.go UERadioCapabilityCheckResponse null pointer dereferenceGo · github.com/omec-project/amf · fixed in 2.2.0
- CVE-2026-8782omec-project amf NGAP Message handler.go null pointer dereferenceGo · github.com/omec-project/amf · fixed in 2.2.0
- CVE-2026-8781omec-project amf handler.go RANConfiguration null pointer dereferenceGo · github.com/omec-project/amf · fixed in 2.2.0
- CVE-2026-8780omec-project amf NGAP Message dispatcher.go memory corruptionGo · github.com/omec-project/amf · fixed in 2.2.0
- CVE-2026-8779omec-project amf handler.go NGSetupRequest memory corruptionGo · github.com/omec-project/amf · fixed in 2.2.0
- CVE-2026-4053post edit time limit is not enforced on some post update operationsGo · github.com/mattermost/mattermost-server · fixed in 0.0.0-20260414103857-b21ef302025e, 11.5.2+incompatible, 11.5.2
- CVE-2026-4054SVG content served through Mattermost image proxy despite Content-Type restrictions causes client-side denial of serviceGo · github.com/mattermost/mattermost-server · fixed in 11.5.2, 0.0.0-20260414103857-b21ef302025e, 11.4.4 and more
- CVE-2026-44774Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=falseGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.46, 3.7.1, 3.6.17
- CVE-2026-41181Traefik: Errors middleware forwards Authorization and Cookie headers to separate error page serviceGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.44, 3.6.15, 3.7.0-rc.3
- CVE-2026-44309gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commitsGo · github.com/sigstore/gitsign · fixed in 0.16.0
- CVE-2026-44310gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callersGo · github.com/sigstore/gitsign · fixed in 0.15.0
- CVE-2026-45803gh: GitHub Actions log output in `gh run view` allows terminal escape sequence injectionGo · github.com/cli/cli, github.com/cli/cli/v2 · fixed in 2.92.0
- CVE-2026-44671ZITADEL: LDAP Filter Injection in Login FlowGo · github.com/zitadel/zitadel · fixed in 4.15.0, 3.4.10
- CVE-2026-44428MCP Registry: GitHub OIDC tokens replayable across registry deployments due to shared audienceGo · github.com/modelcontextprotocol/registry · fixed in 1.7.6
- CVE-2026-44427MCP Registry: Open RedirectGo · github.com/modelcontextprotocol/registry · fixed in 1.7.5
- CVE-2026-44429MCP Registry: Stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl`Go · github.com/modelcontextprotocol/registry · fixed in 1.7.7
- CVE-2026-44430MCP Registry: Unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlistGo · github.com/modelcontextprotocol/registry · fixed in 1.7.7
- CVE-2026-45781MCP Registry: OCI ownership validation fails open on upstream rate limits, allowing attacker-controlled package claimsGo · github.com/modelcontextprotocol/registry · fixed in 1.7.9
- CVE-2026-8634Crabbox < v0.12.0 Environment Variable Information DisclosureGo · github.com/openclaw/crabbox · fixed in 0.12.0