Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-37461An out-of-bounds read in the ParseIP6Extended function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) viaGo · github.com/osrg/gobgp/v4 · fixed in 4.4.0
- CVE-2026-43824In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data.Go · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 +1 · fixed in 3.2.11, 3.3.9
- CVE-2026-41263Traefik: BasicAuth middleware: timing side-channel vulnerabilityGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.43, 3.6.14, 3.7.0-rc.2
- CVE-2026-40912Traefik: StripPrefixRegex auth bypass via Path/RawPath desyncGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.43, 3.6.14, 3.7.0-rc.2
- CVE-2026-39858Traefik: Forwarded alias spoofing top pre-auth decision bypassGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.43, 3.7.0-rc.2, 3.6.14
- CVE-2026-35051Traefik: ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass authGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.43, 3.7.0-rc.2, 3.6.14
- CVE-2026-41174Traefik Kubernetes CRD allows unauthorized cross-namespace middleware bindingGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.43, 3.6.14, 3.7.0-rc.2
- CVE-2026-7461OS Command Injection in Amazon ECS Agent via FSx Windows File Server Volume CredentialsGo · github.com/aws/amazon-ecs-agent · fixed in 1.103.0
- CVE-2026-33467Improper Verification of Cryptographic Signature in Elastic Package Registry Leading to Package Integrity BypassGo · github.com/elastic/package-registry · fixed in 1.38.0
- CVE-2026-41602Apache Thrift: Go TFramedTransport uint32 overflowGo · github.com/apache/thrift · fixed in 0.23.0
- CVE-2026-38651Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0.Go · github.com/gravitl/netmaker · fixed in 1.5.0
- CVE-2026-6970authd Denial of Service and Local Privilege EscalationGo · github.com/canonical/authd · fixed in 0.6.4
- CVE-2026-7020Ollama Tensor Model Transfer transfer.go digestToPath path traversalGo · github.com/ollama/ollama
- CVE-2026-6993go-kratos http.DefaultServeMux Fallback server.go NewServer confused deputyGo · github.com/go-kratos/kratos/v2
- CVE-2026-6987PicoClaw Web Launcher Management Plane restart command injectionGo · github.com/sipeed/picoclaw
- CVE-2026-41433OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIRGo · go.opentelemetry.io/obi · fixed in 0.8.0
- CVE-2026-41894SiYuan: Incomplete Fix Bypass for CVE-2026-30869: Path Traversal via Double URL Encoding in `/export/` EndpointGo · github.com/siyuan-note/siyuan/kernel · fixed in 3.6.5
- CVE-2026-41326Kata Containers: CopyFile Policy Subversion via SymlinksGo · github.com/kata-containers/kata-containers · fixed in 0.0.0-20260422180503-1b9e49eb2763
- CVE-2026-41492Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in DgraphGo · github.com/dgraph-io/dgraph, github.com/dgraph-io/dgraph/v24 +2 · fixed in 25.3.3, 24.1.9
- CVE-2026-41327Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition FieldGo · github.com/dgraph-io/dgraph, github.com/dgraph-io/dgraph/v24 +2 · fixed in 25.3.3, 24.1.8
- CVE-2026-41328Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang FieldGo · github.com/dgraph-io/dgraph, github.com/dgraph-io/dgraph/v24 +2 · fixed in 25.3.3, 24.1.9
- CVE-2026-21728Tempo query limit results in unbounded memory allocationGo · github.com/grafana/tempo · fixed in 2.8.4, 2.9.2, 2.10.2
- CVE-2026-41485Kyverno Controller Denial of Service via forEach Mutation PanicGo · github.com/kyverno/kyverno · fixed in 1.16.4, 1.17.2
- CVE-2026-41323Kyverno: ServiceAccount token leaked to external servers via apiCall service URLGo · github.com/kyverno/kyverno · fixed in 1.17.0
- CVE-2026-41068Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix)Go · github.com/kyverno/kyverno
- CVE-2026-32952go-ntlmssp NTLM challenges can panic on malformed payloadsGo · github.com/azure/go-ntlmssp · fixed in 0.1.1
- CVE-2026-29051melange has Path Traversal via .PKGINFO in --persist-lint-resultsGo · chainguard.dev/melange · fixed in 0.43.4
- CVE-2026-29050melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].usesGo · chainguard.dev/melange · fixed in 0.43.4
- CVE-2026-41246Contour: Lua code injection via Cookie Path Rewrite PolicyGo · github.com/projectcontour/contour · fixed in 1.31.6, 1.32.5, 1.33.4
- CVE-2026-40886Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controllerGo · github.com/argoproj/argo-workflows, github.com/argoproj/argo-workflows/v2 +2 · fixed in 3.7.14, 4.0.5