Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-41179RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command executionGo · github.com/ncw/rclone, github.com/rclone/rclone · fixed in 1.73.5
- CVE-2026-39087ntfy before 2.22.0 allows SSRF because of an unanchored regular expression for web push endpoint URLs.Go · heckel.io/ntfy, heckel.io/ntfy/v2 · fixed in 2.22.0
- CVE-2026-41176Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command executionGo · github.com/rclone/rclone · fixed in 1.73.5
- CVE-2026-32885DDEV has ZipSlip path traversal in tar and zip archive extractionGo · github.com/ddev/ddev · fixed in 1.25.2
- CVE-2026-41145MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer UploadsGo · github.com/minio/minio
- CVE-2026-40344MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer UploadsGo · github.com/minio/minio
- CVE-2026-41136free5GC AMF missing default case in Content-Type switch in HTTPUEContextTransferGo · github.com/free5gc/amf
- CVE-2026-41135free5GC PCF: Memory Leak via CORS Middleware Registration in HTTP Handler Leads to Denial of ServiceGo · github.com/free5gc/pcf · fixed in 1.4.3
- CVE-2026-40343free5GC UDR: Fail-open handling in PolicyDataSubsToNotifyPost allows unintended subscription creationGo · github.com/free5gc/udr
- CVE-2026-41131OpenFGA has Improper Policy EnforcementGo · github.com/openfga/openfga · fixed in 1.14.1
- CVE-2026-40575OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header SpoofingGo · github.com/oauth2-proxy/oauth2-proxy, github.com/oauth2-proxy/oauth2-proxy/v7 · fixed in 7.15.2
- CVE-2026-41059OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regexGo · github.com/oauth2-proxy/oauth2-proxy, github.com/oauth2-proxy/oauth2-proxy/v7 · fixed in 7.15.2
- CVE-2026-40946Oxia: OIDC token audience validation bypass via SkipClientIDCheckGo · github.com/oxia-db/oxia · fixed in 0.16.2
- CVE-2026-40945Oxia: Bearer token exposed in debug log messages on authentication failureGo · github.com/oxia-db/oxia · fixed in 0.16.2
- CVE-2026-40944Oxia: TLS CA certificate chain validation fails with multi-certificate PEM bundlesGo · github.com/oxia-db/oxia · fixed in 0.16.2
- CVE-2026-40943Oxia: Server crash via race condition in session heartbeat handlingGo · github.com/oxia-db/oxia · fixed in 0.16.2
- CVE-2026-40923Tekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekton/ checkGo · github.com/tektoncd/pipeline · fixed in 1.0.2, 1.3.4, 1.6.2 and more
- CVE-2026-40924Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory ExhaustionGo · github.com/tektoncd/pipeline · fixed in 1.11.1, 1.0.2, 1.3.4 and more
- CVE-2026-40938Tekton Pipelines: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCEGo · github.com/tektoncd/pipeline · fixed in 1.0.2, 1.3.4, 1.6.2 and more
- CVE-2026-40910frp: Authentication bypass in frp HTTP vhost routing when routeByHTTPUser is used for access controlGo · github.com/fatedier/frp · fixed in 0.68.1
- CVE-2026-40890github.com/gomarkdown/markdown: Out-of-bounds Read in SmartypantsRendererGo · github.com/gomarkdown/markdown · fixed in 0.0.0-20260411013819-759bbc3e3207
- CVE-2026-40885goshs: Public collaborator feed leaks .goshs ACL credentials and enables unauthorized accessGo · github.com/patrickhener/goshs, github.com/patrickhener/goshs/v2 · fixed in 2.0.0-beta.6
- CVE-2026-40884goshs: Empty-username SFTP password authentication bypass in goshsGo · github.com/patrickhener/goshs, github.com/patrickhener/goshs/v2 · fixed in 2.0.0
- CVE-2026-40883goshs: CSRF in state-changing GET routes enables authenticated file deletion and directory creationGo · github.com/patrickhener/goshs, github.com/patrickhener/goshs/v2 · fixed in 2.0.0-beta.6
- CVE-2026-40876SFTP root escape via prefix-based path validation in goshsGo · github.com/patrickhener/goshs, github.com/patrickhener/goshs/v2 · fixed in 2.0.0
- CVE-2026-33812Excessive memory allocation when decoding malicious SFNT in golang.org/x/imageGo · golang.org/x/image · fixed in 0.39.0
- CVE-2026-33813Panic when decoding large WEBP image on 32-bit platforms in golang.org/x/imageGo · golang.org/x/image · fixed in 0.42.0
- CVE-2026-40868kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount tokenGo · github.com/kyverno/kyverno · fixed in 1.17.0
- CVE-2026-40611Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 ProviderGo · github.com/go-acme/lego, github.com/go-acme/lego/v3 +1 · fixed in 4.34.0
- CVE-2026-40574OAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email ClaimsGo · github.com/oauth2-proxy/oauth2-proxy, github.com/oauth2-proxy/oauth2-proxy/v7 · fixed in 7.15.2