Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-42596Gotenberg: Unauthenticated SSRF via default deny-list bypass in downloadFrom and webhookGo · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8 · fixed in 8.32.0
- CVE-2026-40893Gotenberg: ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names Allows Arbitrary File Rename and MoveGo · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8
- CVE-2026-42589Gotenberg: Unauthenticated RCE via ExifTool Metadata Key InjectionGo · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8
- CVE-2026-42186OpenBao's Namespace Deletion May Not Delete Data ProperlyGo · github.com/openbao/openbao · fixed in 0.0.0-20260420173541-6d2e0506e2b4
- CVE-2026-43644podinfo 6.11.2 Reflected XSS via /echo EndpointGo · github.com/stefanprodan/podinfo · fixed in 1.8.1-0.20260519111337-cbebb20fd485
- CVE-2026-44423ShellHub: Cross-tenant IDOR in `GET /api/sessions/:uid` discloses SSH session dataGo · github.com/shellhub-io/shellhub · fixed in 0.24.2
- CVE-2026-44424ShellHub: Cross-tenant IDOR in `GET /api/devices/:uid` discloses device data of any namespaceGo · github.com/shellhub-io/shellhub · fixed in 0.24.2
- CVE-2026-44426ShellHub: Cross-tenant IDOR in `GET /api/namespaces/:tenant` via API Key bypasses membership checkGo · github.com/shellhub-io/shellhub · fixed in 0.24.2
- CVE-2026-44425ShellHub: Crash-DoS via field injection in filter and sort-by parametersGo · github.com/shellhub-io/shellhub · fixed in 0.24.2
- CVE-2026-42602azureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replayGo · github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension · fixed in 0.151.0
- CVE-2026-33380SQL Expressions Read File From DiskGo · github.com/grafana/grafana · fixed in 1.9.2-0.20260513165311-fb7336fc36c1
- CVE-2026-33381Users can generate Service Account tokens after permissions removalGo · github.com/grafana/grafana · fixed in 1.9.2-0.20260513165311-fb7336fc36c1
- CVE-2026-41050Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template renderingGo · github.com/rancher/fleet · fixed in 0.15.1, 0.14.5, 0.13.10 and more
- CVE-2026-25705Rancher Extensions have arbitrary file access via path traversalGo · github.com/rancher/rancher · fixed in 2.14.1, 2.13.5, 2.12.9 and more
- CVE-2026-44245Kyverno: [policy-reporter-ui] XSS via Stored Property Values in PropertyCard ComponentGo · github.com/kyverno/policy-reporter-ui · fixed in 2.5.2+incompatible, 2.5.2
- CVE-2026-44301Hugo: Node tool execution allows file system access outside the project directoryGo · github.com/gohugoio/hugo · fixed in 0.161.0
- CVE-2026-44015Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal ServicesGo · github.com/0xjacky/nginx-ui
- CVE-2026-7474Nomad vulnerable to path traversal in dynamic host volume which may lead to code executionGo · github.com/hashicorp/nomad · fixed in 1.11.0-rc.1.0.20260511152149-cd7240c4099a
- CVE-2026-8052Nomad's exec2 task driver vulnerable to arbitrary file read/write on client host through symlink attackGo · github.com/hashicorp/nomad-driver-exec2 · fixed in 0.1.2
- CVE-2026-6959Nomad vulnerable to arbitrary file read/write on client host through symlink attackGo · github.com/hashicorp/nomad · fixed in 1.11.0-rc.1.0.20260512123500-2a09fd62c238
- CVE-2026-42541Kubewarden: RBAC Reconnaissance via unchecked can_i host capability callGo · github.com/kubewarden/kubewarden-controller · fixed in 1.35.0
- CVE-2026-42300DevGuard: Unauthenticated identity assertion via `X-Admin-Token` headerGo · github.com/l3montree-dev/devguard · fixed in 1.2.2
- CVE-2026-44166Pocketbase: Account pre-hijacking via OAuth2 unverfied->verified autolinking upgradeGo · github.com/pocketbase/pocketbase · fixed in 0.22.42, 0.37.4
- CVE-2026-43983Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictionsGo · github.com/pocket-id/pocket-id/backend · fixed in 0.0.0-20260419162744-978ac87deffe
- CVE-2026-8349omec-project amf NGAP Message memory corruptionGo · github.com/omec-project/amf
- CVE-2026-42554Fiber: XSS in AutoFormat Content NegotiationGo · github.com/gofiber/fiber/v2, github.com/gofiber/fiber/v3 · fixed in 2.52.13, 3.2.0
- CVE-2026-42600MinIO: Path Traversal via msgpack Body in `ReadMultiple` Storage-REST EndpointGo · github.com/minio/minio · fixed in 0.0.0-20260414213245
- CVE-2026-42882oxyno-zeta/s3-proxy: Security Issues in Resource Path MatchingGo · github.com/oxyno-zeta/s3-proxy · fixed in 0.0.0-20260424211602-1320e4abd46a
- CVE-2026-42876External Secrets Operator: Privilege escalation with secret overwritingGo · github.com/external-secrets/external-secrets/apis · fixed in 2.4.1
- CVE-2026-42875External Secrets Operator: Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStoreGo · github.com/external-secrets/external-secrets · fixed in 2.4.0