Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-40161Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURLGo · github.com/tektoncd/pipeline · fixed in 1.0.2, 1.3.4, 1.6.2 and more
- CVE-2026-25542Tekton Pipelines: VerificationPolicy regex pattern bypass via substring matchingGo · github.com/tektoncd/pipeline · fixed in 1.0.2, 1.3.4, 1.6.2 and more
- CVE-2026-39386Neko has Self-service Privilege Escalation for Authenticated UsersGo · github.com/m1k1o/neko/server · fixed in 0.0.0-20260406184107-c54bcf1ee211, 3.0.11
- CVE-2026-40264OpenBao's Token Store Allows Cross-Namespace Renewal, RevocationGo · github.com/openbao/openbao · fixed in 0.0.0-20260420162526-f58111d2ca54
- CVE-2026-39396OpenBao has Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS)Go · github.com/openbao/openbao · fixed in 0.0.0-20260420180337-2b2a901aa9f7
- CVE-2026-39388OpenBao's Certificate Authentication Allows Token Renewal With Different CertificateGo · github.com/openbao/openbao · fixed in 0.0.0-20260420160924-abe84e1af4c3
- CVE-2026-39946OpenBao allows SQL Injection in PostgreSQL database secrets engineGo · github.com/openbao/openbao · fixed in 0.0.0-20260420155735-b596b0882620
- CVE-2026-34403Nginx-UI vulnerable to Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpointsGo · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260316053337-1a9cd29a3082
- CVE-2026-33031Nginx-UI: Disabled users retain full API access through previously issued bearer tokensGo · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260314152518-7b66578adb47
- CVE-2026-6634usememos UpdateInstanceSetting App.tsx memos_access_token improper authorizationGo · github.com/usememos/memos
- CVE-2026-41282ProjectDiscovery Nuclei 3 before 3.8.0 allows DSL expression injection.Go · github.com/projectdiscovery/nuclei, github.com/projectdiscovery/nuclei/v2 +1 · fixed in 3.8.0
- CVE-2026-40481monetr: Unauthenticated Stripe webhook reads attacker-sized request bodies before signature validationGo · github.com/monetr/monetr · fixed in 1.12.4
- CVE-2026-40304zrok's broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend recordsGo · github.com/openziti/zrok, github.com/openziti/zrok/v2 · fixed in 2.0.1
- CVE-2026-40303zrok allows unauthenticated DoS via unbounded memory allocation in striped session cookie parsingGo · github.com/openziti/zrok, github.com/openziti/zrok/v2 · fixed in 2.0.1
- CVE-2026-40302zrok has reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error renderingGo · github.com/openziti/zrok, github.com/openziti/zrok/v2 · fixed in 2.0.1
- CVE-2026-40293OpenFGA Playground Preshared Key ExposureGo · github.com/openfga/openfga · fixed in 1.14.0
- CVE-2026-6437AWS EFS CSI Driver Mount Option InjectionGo · github.com/kubernetes-sigs/aws-efs-csi-driver · fixed in 1.7.8-0.20260416142831-51806c22c575
- CVE-2026-5807Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey OperationsGo · github.com/hashicorp/vault
- CVE-2026-4525Vault Token Leaked to Backends via Authorization: Bearer Passthrough HeaderGo · github.com/hashicorp/vault
- CVE-2026-5052Vault Vulnerable to Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNSGo · github.com/hashicorp/vault
- CVE-2026-3605Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-ServiceGo · github.com/hashicorp/vault
- CVE-2026-40265Note Mark has Broken Access Control on Asset DownloadGo · github.com/enchant97/note-mark/backend · fixed in 0.0.0-20260411145023-6593898855ad
- CVE-2026-40263Note Mark: Username Enumeration via Login Endpoint Timing Side-ChannelGo · github.com/enchant97/note-mark/backend · fixed in 0.19.2-0.20260411145025-cf4c6f6acf70
- CVE-2026-40262Note Mark has Stored XSS via Unrestricted Asset UploadGo · github.com/enchant97/note-mark/backend · fixed in 0.0.0-20260411145018-6bb62842ccb9
- CVE-2026-40922SiYuan: Incomplete sanitization of bazaar README allows stored XSS via iframe srcdoc (incomplete fix for CVE-2026-33066)Go · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260414013942-62eed37a3263
- CVE-2026-40318SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`Go · github.com/siyuan-note/siyuan/kernel · fixed in 3.6.40.0.0-20260407035653-2f416e5253f1
- CVE-2026-40259SiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via removeUnusedAttributeView APIGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260407035653-2f416e5253f1
- CVE-2026-40249free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errorsGo · github.com/free5gc/udr
- CVE-2026-40248free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence SubscriptionsGo · github.com/free5gc/udr
- CVE-2026-40247free5gc UDR improper path validation allows unauthenticated access to Traffic Influence SubscriptionsGo · github.com/free5gc/udr