Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-45224Crabbox < 0.9.0 Path Traversal via Islo Provider Workspace ResolutionGo · github.com/openclaw/crabbox · fixed in 0.9.0
- CVE-2026-6815CVE-2026-6815Go · github.com/casdoor/casdoor
- CVE-2026-8276bettercap MySQL Server mysql_server.go integer coercionGo · github.com/bettercap/bettercap/v2 · fixed in 2.41.7
- CVE-2026-8275bettercap zerogod IPP Service zerogod_ipp_primitives.go ippReadChunkedBody integer coercionGo · github.com/bettercap/bettercap, github.com/bettercap/bettercap/v2 · fixed in 2.41.7
- CVE-2026-42576apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discoveryGo · chainguard.dev/apko · fixed in 1.2.7
- CVE-2026-42575apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)Go · chainguard.dev/apko · fixed in 1.2.7
- CVE-2026-42574apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build rootGo · chainguard.dev/apko · fixed in 1.2.5
- CVE-2026-42571Privilege Escalation Attack affecting Pelican Web UIGo · github.com/pelicanplatform/pelican · fixed in 0.0.0-20260408120501-7f73b9c3e677
- CVE-2026-42560auth: Patreon provider assigns the same local user ID to every authenticated Patreon account, enabling cross‑user impersonationGo · github.com/go-pkgz/auth, github.com/go-pkgz/auth/v2 · fixed in 1.25.2, 2.1.2
- CVE-2026-42296Argo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/SecureGo · github.com/argoproj/argo-workflows, github.com/argoproj/argo-workflows/v2 +2 · fixed in 3.7.14, 4.0.5
- CVE-2026-42295Argo Workflows: Exposure of artifact repository credentialsGo · github.com/argoproj/argo-workflows, github.com/argoproj/argo-workflows/v2 +2 · fixed in 4.0.5
- CVE-2026-42294Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook InterceptorGo · github.com/argoproj/argo-workflows, github.com/argoproj/argo-workflows/v2 +2 · fixed in 3.7.14, 4.0.5
- CVE-2026-42183Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)Go · github.com/argoproj/argo-workflows, github.com/argoproj/argo-workflows/v2 +2 · fixed in 4.0.5
- CVE-2026-42297Argo Workflows Is Missing Authorization in Sync ConfigMap ProviderGo · github.com/argoproj/argo-workflows, github.com/argoproj/argo-workflows/v2 +2 · fixed in 4.0.5
- CVE-2026-42461Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets)Go · github.com/getarcaneapp/arcane/backend · fixed in 1.18.0
- CVE-2026-42350Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Query ParameterGo · github.com/akuity/kargo · fixed in 1.7.10, 1.8.13, 1.9.8 and more
- CVE-2026-42339New API: SSRF Filter Bypass via 0.0.0.0Go · github.com/quantumnous/new-api
- CVE-2026-41432New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota FraudGo · github.com/quantumnous/new-api · fixed in 0.12.10
- CVE-2026-41520Cillium exposes sensitive information included in the cilium-bugtool debug archiveGo · github.com/cilium/cilium · fixed in 1.17.15, 1.18.9, 1.19.3
- CVE-2026-42072Nornicdb: Improper Network Binding in NornicDB Bolt Server allows unauthorized remote accessGo · github.com/orneryd/nornicdb · fixed in 1.0.42-hotfix
- CVE-2026-41889pgx: SQL Injection via placeholder confusion with dollar quoted string literalsGo · github.com/jackc/pgx, github.com/jackc/pgx/v4 +1 · fixed in 5.9.2
- CVE-2026-41070openvpn-auth-oauth2 returns FUNC_SUCCESS on client-deny, allowing unauthenticated VPN accessGo · github.com/jkroepke/openvpn-auth-oauth2 · fixed in 1.27.3
- CVE-2026-41574Nhost Vulnerable to Account Takeover via OAuth Email Verification BypassGo · github.com/nhost/nhost · fixed in 0.0.0-20260417112436-ec8dab3f2cf4
- CVE-2026-41506go-git Credential leak via cross-host redirect in smart HTTP transportGo · github.com/go-git/go-git/v5, github.com/go-git/go-git/v6 · fixed in 5.18.0, 6.0.0-alpha.2
- CVE-2026-41491Dapr: Service Invocation path traversal ACL bypassGo · github.com/dapr/dapr · fixed in 1.17.5, 1.16.14, 1.15.14
- CVE-2026-42275zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/writeGo · github.com/openziti/zrok, github.com/openziti/zrok/v2 · fixed in 2.0.2
- CVE-2026-42274Heimdall: Authorization bypass via path normalization mismatchGo · github.com/dadrus/heimdall · fixed in 0.17.14
- CVE-2026-42273Heimdall: Case-sensitive host matching may lead to policy bypassGo · github.com/dadrus/heimdall · fixed in 0.17.14
- CVE-2026-42272Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretationGo · github.com/dadrus/heimdall · fixed in 0.17.14
- CVE-2026-41645Nuclei: Environment variable disclosure via Response-Derived DSL ExpressionsGo · github.com/projectdiscovery/nuclei, github.com/projectdiscovery/nuclei/v2 +1 · fixed in 3.8.0