Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-96628Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`Go · github.com/getarcaneapp/arcane/backend, github.com/getarcaneapp/arcane/backend/v2 · fixed in 2.11.0
- CVE-2026-102941gomarkdown/markdown IsSafeURL panics on short URLsGo · github.com/gomarkdown/markdown · fixed in 0.0.0-20260724235538-61af6e1e6971
- CVE-2026-100353kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filterGo · github.com/getkin/kin-openapi · fixed in 0.149.0
- CVE-2026-100354kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process CrashGo · github.com/getkin/kin-openapi · fixed in 0.149.0
- CVE-2026-100352kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation PathGo · github.com/getkin/kin-openapi · fixed in 0.148.0
- CVE-2026-100351kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusionGo · github.com/getkin/kin-openapi · fixed in 0.147.0
- CVE-2026-100349kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with contentGo · github.com/getkin/kin-openapi · fixed in 0.146.0
- CVE-2026-100350kin-openapi deepObject query decoding repeatedly compiles an invariant regular expressionGo · github.com/getkin/kin-openapi · fixed in 0.146.0
- CVE-2026-100347kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static pathGo · github.com/getkin/kin-openapi · fixed in 0.145.0
- CVE-2026-100348kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)Go · github.com/getkin/kin-openapi · fixed in 0.145.0
- CVE-2026-97394kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing itemsGo · github.com/getkin/kin-openapi · fixed in 0.143.0
- CVE-2023-32198Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacksGo · github.com/rancher/steve · fixed in 0.2.1, 0.3.3, 0.4.4 and more
- CVE-2024-22031Rancher users who can create Projects can gain access to arbitrary projectsGo · github.com/rancher/rancher · fixed in 2.9.9, 2.10.5, 2.11.1
- CVE-2025-23390Fleet doesn’t validate a server’s certificate when connecting through SSHGo · github.com/rancher/fleet · fixed in 0.10.12, 0.11.7, 0.12.2
- CVE-2026-53999Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs)Go · github.com/radius-project/radius · fixed in 0.58.0
- CVE-2026-102748Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of ServiceGo · github.com/dgraph-io/dgraph/v25 · fixed in 25.4.0
- CVE-2026-77524KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthenticationGo · github.com/kedacore/keda, github.com/kedacore/keda/v2 · fixed in 2.21.0
- CVE-2026-77564Talos Linux: Support bundle does not redact registry credentialsGo · github.com/siderolabs/talos · fixed in 1.14.0-alpha.0.0.20260513110206-76080416beee
- CVE-2026-100394Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenantGo · github.com/nezhahq/nezha · fixed in 0.0.0-20260721131105-c893aa57867d
- CVE-2026-73802Gitea Runner host isolation bypass through container optionsGo · gitea.com/gitea/runner · fixed in 1.0.9-0.20260731160927-34bfa1915022
- CVE-2026-59766Gitea private repository metadata disclosure after access revocationGo · code.gitea.io/gitea, gitea.dev · fixed in 1.27.0
- CVE-2026-104252Vitess vttablet /twopcz reflected XSSGo · vitess.io/vitess · fixed in 0.23.5, 0.24.2
- CVE-2026-85747Distribution: Client `manifests.Get()` does not verify returned content against requested digestGo · github.com/distribution/distribution, github.com/distribution/distribution/v3 +1 · fixed in 3.1.2
- CVE-2026-94603Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotationGo · github.com/containers/podman, github.com/containers/podman/v2 +4 · fixed in 5.8.8, 6.1.3
- CVE-2026-77459Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooksGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 +1 · fixed in 3.3.15, 3.4.10, 3.5.4 and more
- CVE-2026-82416FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared moduleGo · github.com/dunglas/frankenphp · fixed in 1.12.5
- CVE-2026-103028SFTPGo source-side file-pattern filter bypass during copy operationsGo · github.com/drakkan/sftpgo, github.com/drakkan/sftpgo/v2 · fixed in 2.7.6
- CVE-2026-77375SFTPGo: Denial of service via malformed SSH channel requestGo · github.com/drakkan/sftpgo, github.com/drakkan/sftpgo/v2 · fixed in 2.7.5
- CVE-2026-102603Gotify: Insufficiently Protected Password Change endpointGo · github.com/gotify/server, github.com/gotify/server/v2 +1 · fixed in 3.0.0
- CVE-2026-84312Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)Go · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260703131214-23d1934099b0