Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-40243Incus OVN TLS verification accepts peer-supplied roots and permits endpoint impersonationGo · github.com/lxc/incus, github.com/lxc/incus/v6 +2 · fixed in 7.0.0
- CVE-2026-40197Incus nil-pointer dereference in custom volume import allows denial of serviceGo · github.com/lxc/incus, github.com/lxc/incus/v6 +2 · fixed in 7.0.0
- CVE-2026-40195Incus nil-pointer dereference in storage bucket import allows denial of serviceGo · github.com/lxc/incus, github.com/lxc/incus/v6 +2 · fixed in 7.0.0
- CVE-2026-6863HTTP Filestore Endpoints Misapply Permissions Across OrganizationsGo · www.velocidex.com/golang/velociraptor · fixed in 0.76.4
- CVE-2026-7572Velociraptor EVTX Parser — Process Crash via Crafted .evtx FileGo · www.velocidex.com/golang/velociraptor · fixed in 0.76.5
- CVE-2026-7573GetUserRoles API endpoint allows any authenticated user to enumerate ACL policies across all organizationsGo · www.velocidex.com/golang/velociraptor · fixed in 0.76.5
- CVE-2026-39383Gotenberg unauthenticated blind SSRF via unfiltered webhook URLGo · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8 · fixed in 8.31.0
- CVE-2026-35579CoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transportsGo · github.com/coredns/coredns · fixed in 1.14.3
- CVE-2026-35527Incus blind SSRF via image import preflight HEAD requestGo · github.com/lxc/incus, github.com/lxc/incus/v6 +2 · fixed in 7.0.0
- CVE-2026-40280Gotenberg SSRF via case-insensitive URL scheme bypass in webhook and downloadFrom deny-listsGo · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8 · fixed in 8.31.0
- CVE-2026-33489CoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparisonGo · github.com/coredns/coredns · fixed in 1.14.3
- CVE-2026-32936CoreDNS DoH GET path missing size validation causes CPU and memory amplificationGo · github.com/coredns/coredns · fixed in 1.14.3
- CVE-2026-32934CoreDNS DNS-over-QUIC unbounded goroutine growth leads to denial of serviceGo · github.com/coredns/coredns · fixed in 1.14.3
- CVE-2026-33190CoreDNS TSIG authentication bypass on encrypted DNS transportsGo · github.com/coredns/coredns · fixed in 1.14.3
- CVE-2026-30246github.com/gofiber/fiber/v3 cache middleware can mix responses across query parametersGo · github.com/gofiber/fiber/v3 · fixed in 3.2.0
- CVE-2026-7776Boundary Workers Vulnerable to Denial of Service During TLS HandshakeGo · github.com/hashicorp/boundary · fixed in 0.19.5, 0.20.3, 0.21.3
- CVE-2026-42238Unauthenticated Remote Code Execution via Backup Restore in nginx-uiGo · github.com/0xjacky/nginx-ui · fixed in 2.3.8
- CVE-2026-42223nginx-ui: Settings API Exposes Protected SecretsGo · github.com/0xjacky/nginx-ui · fixed in 2.3.8
- CVE-2026-42222nginx-ui: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeoverGo · github.com/0xjacky/nginx-ui
- CVE-2026-42221nginx-ui: Unauthenticated First-Run Installer Allows Remote Initial Admin ClaimGo · github.com/0xjacky/nginx-ui · fixed in 2.3.8
- CVE-2026-42220nginx-ui: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and restore-based nginx-ui state rollbackGo · github.com/0xjacky/nginx-ui
- CVE-2026-42154Prometheus: remote read endpoint allows denial of service via crafted snappy payloadGo · github.com/prometheus/prometheus, github.com/prometheus/prometheus/v2 · fixed in 0.305.2, 0.311.3
- CVE-2026-42151Prometheus Azure AD remote write OAuth client secret exposed via config APIGo · github.com/prometheus/prometheus · fixed in 0.311.3
- CVE-2026-41572Note Mark: Unauthenticated read of notes and assets in soft-deleted public booksGo · github.com/enchant97/note-mark/backend · fixed in 0.0.0-20260417132843-d1bf845a2a2d
- CVE-2026-41571Note Mark: OIDC-registered users authenticated by submitting password "null"Go · github.com/enchant97/note-mark/backend · fixed in 0.0.0-20260417132909-dea5530cc989
- CVE-2026-42091goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORSGo · github.com/patrickhener/goshs, github.com/patrickhener/goshs/v2 +2 · fixed in 2.0.2
- CVE-2026-7482Ollama heap out-of-bounds read in GGUF tensor parsing leaks server process memory to unauthenticated remote attackersGo · github.com/ollama/ollama · fixed in 0.17.1
- CVE-2026-7737osrg GoBGP BMP Parser bmp.go BMPStatisticsReport.ParseBody out-of-boundsGo · github.com/osrg/gobgp, github.com/osrg/gobgp/v4 · fixed in 4.4.0
- CVE-2026-7736osrg GoBGP mrt.go parseRibEntry integer underflowGo · github.com/osrg/gobgp/v4 · fixed in 4.4.0
- CVE-2026-7734osrg GoBGP SRv6 L3 Service prefix_sid.go SRv6L3ServiceAttribute.DecodeFromBytes denial of serviceGo · github.com/osrg/gobgp/v4 · fixed in 4.4.0