Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-42273Heimdall: Case-sensitive host matching may lead to policy bypassGo · github.com/dadrus/heimdall · fixed in 0.17.14
- CVE-2026-42272Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretationGo · github.com/dadrus/heimdall · fixed in 0.17.14
- CVE-2026-41645Nuclei: Environment variable disclosure via Response-Derived DSL ExpressionsGo · github.com/projectdiscovery/nuclei, github.com/projectdiscovery/nuclei/v2 +1 · fixed in 3.8.0
- CVE-2026-41646Nuclei: Local File Read via require() Module Loader BypassGo · github.com/projectdiscovery/nuclei, github.com/projectdiscovery/nuclei/v2 +1 · fixed in 3.8.0
- CVE-2026-42880ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret ExtractionGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 +1 · fixed in 3.2.11, 3.3.9
- CVE-2026-39820Quadratic string concatentation in consumeComment in net/mailGo · stdlib · fixed in 1.25.10, 1.26.3
- CVE-2026-42501Malicious module proxy can bypass checksum database in cmd/goGo · toolchain · fixed in 1.25.10, 1.26.3
- CVE-2026-39823Bypass of meta content URL escaping causes XSS in html/templateGo · stdlib · fixed in 1.25.10, 1.26.3
- CVE-2026-33811Crash when handling long CNAME response in netGo · stdlib · fixed in 1.25.10, 1.26.3
- CVE-2026-39826Escaper bypass leads to XSS in html/templateGo · stdlib · fixed in 1.25.10, 1.26.3
- CVE-2026-39817Invoking "go tool pack" does not sanitize output paths in cmd/goGo · toolchain · fixed in 1.25.10, 1.26.3
- CVE-2026-39819Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/goGo · toolchain · fixed in 1.25.10, 1.26.3
- CVE-2026-42499Quadratic string concatenation in consumePhrase in net/mailGo · stdlib · fixed in 1.25.10, 1.26.3
- CVE-2026-39825ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputilGo · stdlib · fixed in 1.25.10, 1.26.3
- CVE-2026-39836Panic in Dial and LookupPort when handling NUL byte on Windows in netGo · stdlib · fixed in 1.25.10, 1.26.3
- CVE-2026-33814Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/netGo · golang.org/x/net, stdlib · fixed in 0.53.0, 1.25.10, 1.26.3
- CVE-2026-44349Daptin fuzzy search injects unvalidated column name into raw SQLGo · github.com/daptin/daptin · fixed in 0.11.5
- CVE-2026-41422Daptin vulnerable to SQL injection via unvalidated goqu.L() calls in aggregate APIGo · github.com/daptin/daptin · fixed in 0.11.4
- CVE-2026-41589Wish has SCP Path Traversal that allows arbitrary file read/writeGo · charm.land/wish/v2, github.com/charmbracelet/wish · fixed in 2.0.1
- CVE-2026-41685Incus: Unbounded binary import disk exhaustionGo · github.com/lxc/incus, github.com/lxc/incus/v6 +1
- CVE-2026-41684Incus: Nil Dereferences on Restore via Malformed YAMLGo · github.com/lxc/incus, github.com/lxc/incus/v6 +1
- CVE-2026-41648Incus: Unbounded YAML Metadata Decode via ParsingGo · github.com/lxc/incus, github.com/lxc/incus/v6 +1
- CVE-2026-41647Incus: Nil-Pointer Dereference via S3 Bucket ImportGo · github.com/lxc/incus, github.com/lxc/incus/v6 +1
- CVE-2026-41644monetr is vulnerable to server-side request forgery in Lunch Flow link creation and refreshGo · github.com/monetr/monetr · fixed in 1.12.5
- CVE-2026-41643GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATEGo · github.com/osrg/gobgp/v4 · fixed in 4.3.0
- CVE-2026-42285GoBGP: Panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference)Go · github.com/osrg/gobgp/v4 · fixed in 4.5.0
- CVE-2026-41642GoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path AttributeGo · github.com/osrg/gobgp/v4 · fixed in 4.4.0
- CVE-2026-41413Istio Vulnerable to SSRF via RequestAuthentication jwksUriGo · istio.io/istio · fixed in 0.0.0-20260410004459-189832a289c1
- CVE-2026-40281Gotenberg vulnerable to argument injection via newlines in ExifTool metadata valuesGo · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8 · fixed in 8.31.0
- CVE-2026-40251Incus out-of-bounds panic in snapshot metadata handling allows denial of serviceGo · github.com/lxc/incus, github.com/lxc/incus/v6 +2 · fixed in 7.0.0