Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-46356Fleet: IP spoofing allows bypassing API rate limitingGo · github.com/fleetdm/fleet/v4 · fixed in 4.80.1
- CVE-2026-26191Fleet vulnerable to OS command injection in software packagesGo · github.com/fleetdm/fleet/v4 · fixed in 4.81.1
- CVE-2026-26062Fleet server may terminate unexpectedly when handling certain gRPC requestsGo · github.com/fleetdm/fleet/v4 · fixed in 4.81.0
- CVE-2026-24899Fleet Windows MDM Azure AD JWT Authentication BypassGo · github.com/fleetdm/fleet/v4 · fixed in 4.82.0
- CVE-2026-24000Fleet has a rate limiting bypass via untrusted client IP headersGo · github.com/fleetdm/fleet/v4 · fixed in 4.80.1
- CVE-2026-23998Fleet has a Windows MDM management endpoint authentication bypassGo · github.com/fleetdm/fleet/v4 · fixed in 4.81.0
- CVE-2026-8621Crabbox < v0.12.0 Authentication Bypass via Header SpoofingGo · github.com/openclaw/crabbox · fixed in 0.12.0
- CVE-2026-44522Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leading to Remote Code ExecutionGo · github.com/enchant97/note-mark/backend · fixed in 0.0.0-20260501152243-db3f72bff780
- CVE-2026-44523Note Mark: JWT Secret Weakness allows Full Account Takeover via token forgeryGo · github.com/enchant97/note-mark/backend · fixed in 0.0.0-20260501152247-18b587758667
- CVE-2026-44670SiYuan: Stored XSS via Attribute View name to Electron renderer RCE in SiYuanGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260512140701-d7b77d945e0d
- CVE-2026-44588SiYuan: URL-encoded title bypasses `escapeAriaLabel`, decoded by `decodeURIComponent` into a tooltip-XSSGo · github.com/siyuan-note/siyuan/kernel
- CVE-2026-45147SiYuan: Broken access control in SiYuan `/api/tag/getTag` — Reader role can mutate `Conf.Tag.Sort` and persist to diskGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260512140701-d7b77d945e0d
- CVE-2026-45148SiYuan: Broken access control in SiYuan publish-mode Readers can enumerate metadataGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260512140701-d7b77d945e0d
- CVE-2026-45371SiYuan: SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIsGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260512140701-d7b77d945e0d
- CVE-2026-45375SiYuan: Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code executionGo · github.com/siyuan-note/siyuan/kernel
- CVE-2026-44544gittuf: Policy can be rolled back to prior valid versionGo · github.com/gittuf/gittuf · fixed in 0.14.0
- CVE-2026-44542FileBrowser Quantum: Unauthenticated Path Traversal in Public Share Delete Allows Arbitrary File DeletionGo · github.com/gtsteffaniak/filebrowser · fixed in 0.0.0-20260501183844-112740bdd41d
- CVE-2026-44283etcd: Read access via PrevKv in etcd transactions may bypass RBAC authorization checksGo · go.etcd.io/etcd, go.etcd.io/etcd/server/v3 +1 · fixed in 3.4.44, 3.5.30, 3.6.11
- CVE-2026-42572Hatchet: Cross-tenant information disclosure in `listTasksByDAGIds`Go · github.com/hatchet-dev/hatchet · fixed in 0.83.39
- CVE-2026-41888Distribution: Tag deletion bypasses `storage.delete.enabled` configurationGo · github.com/distribution/distribution, github.com/distribution/distribution/v3 · fixed in 3.1.1
- CVE-2026-44514Kubetail: Cross-Site WebSocket Hijacking allows attacker to read Kubernetes logs from authenticated usersGo · github.com/kubetail-org/kubetail/modules/cli, github.com/kubetail-org/kubetail/modules/dashboard · fixed in 0.16.0, 0.14.0
- CVE-2026-44503Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirectGo · github.com/microsoft/kiota-http-go · fixed in 1.5.5
- CVE-2026-42283DevSpace UI Server WebSocket CheckOrigin does not validate sourceGo · github.com/loft-sh/devspace · fixed in 6.3.21
- CVE-2026-42590Gotenberg: ExifTool group-prefix syntax bypasses dangerous-tag blocklistGo · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8
- CVE-2026-42597Gotenberg: Chromium URL conversion routes read arbitrary files under /tmp via file:// schemeGo · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8 · fixed in 8.32.0
- CVE-2026-42595Gotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List BypassGo · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8 · fixed in 8.32.0
- CVE-2026-42594Gotenberg: Unauthenticated denial of service via echo.Context pool reuse in webhook async goroutineGo · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8 · fixed in 8.32.0
- CVE-2026-42593Gotenberg: Arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routesGo · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8
- CVE-2026-42592Gotenberg: DNS rebinding bypasses SSRF validation on Chromium URL conversion routesGo · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8
- CVE-2026-42591Gotenberg: Server-Side Request Forgery (SSRF) in github.com/gotenberg/gotenberg/v8Go · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8