Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-40246free5gc UDR improper path validation allows unauthenticated deletion of Traffic Influence SubscriptionsGo · github.com/free5gc/udr
- CVE-2026-35469SpdyStream: DOS on CRIGo · github.com/moby/spdystream · fixed in 0.5.1
- CVE-2026-40245Free5GC: UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authenticationGo · github.com/free5gc/udr
- CVE-2026-40193Maddy Mail Server: LDAP Filter Injection via Unsanitized UsernameGo · github.com/foxcpp/maddy · fixed in 0.9.3
- CVE-2026-39350Istio AuthorizationPolicy Incorrect Regex Matching of Dots in serviceAccounts Fields Allows Policy BypassGo · istio.io/istio · fixed in 0.0.0-20260403004500-692e460c342d
- CVE-2026-40179Prometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorerGo · github.com/prometheus/prometheus · fixed in 0.311.2-0.20260410083055-07c6232d159b, 3.5.2, 3.11.2
- CVE-2026-40173Dgraph: Unauthenticated pprof endpoint leaks admin auth tokenGo · github.com/dgraph-io/dgraph, github.com/dgraph-io/dgraph/v24 +2 · fixed in 25.3.2, 24.1.9
- CVE-2026-21726Loki Path Traversal - CVE-2021-36156 BypassGo · github.com/grafana/loki, github.com/grafana/loki/v3 · fixed in 3.6.4
- CVE-2025-41118Sensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protectionGo · github.com/grafana/pyroscope · fixed in 1.15.2, 1.16.1
- CVE-2026-21727Grafana Correlations: Cross-Tenant Data Disclosure and Permanent Deletion via Legacy org_id=0 RecordGo · github.com/grafana/grafana · fixed in 1.9.2-0.20260127141016-e702db6096e0
- CVE-2026-6383Kubevirt: kubevirt: unauthorized subresource access due to improper rbac evaluationGo · kubevirt.io/kubevirt
- CVE-2026-6290Velociraptor Query() Plugin Misapplies Permissions To OrgsGo · www.velocidex.com/golang/velociraptor
- CVE-2026-3590Race Condition in Guest Magic Link Authentication Allows Token ReuseGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.13+incompatible, 11.3.3+incompatible, 11.4.3+incompatible and more
- CVE-2026-28741CSRF Protection Bypass Allows Updating a User's Authentication MethodGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 11.3.3+incompatible, 11.4.3+incompatible, 11.5.0+incompatible and more
- CVE-2026-27769Connected Workspaces: Malicious remote server can manipulate arbitrary user's statusGo · github.com/mattermost/mattermost-server · fixed in 8.0.0-20260316060126-bc1a2b34b1f9
- CVE-2026-5160Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting (XSS) due to improper orGo · github.com/yuin/goldmark, github.com/yuin/goldmark/renderer/html · fixed in 1.7.17
- CVE-2024-53412Command injection in the connect function in NietThijmen ShoppingCart 0.0.2 allows an attacker to execute arbitrary shell commands and achieGo · github.com/nietthijmen/shoppingcart
- CVE-2026-40091SpiceDB: SPICEDB_DATASTORE_CONN_URI is leaked on startup logsGo · github.com/authzed/spicedb · fixed in 1.51.1
- CVE-2026-40090Zarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File WriteGo · github.com/defenseunicorns/zarf, github.com/zarf-dev/zarf · fixed in 0.74.2
- CVE-2026-39984Sigstore Timestamp Authority has Improper Certificate Validation in verifierGo · github.com/sigstore/timestamp-authority, github.com/sigstore/timestamp-authority/v2 · fixed in 2.0.6
- CVE-2026-33414PowerShell Command Injection in Podman HyperV MachineGo · github.com/containers/podman, github.com/containers/podman/v2 +3 · fixed in 5.8.2
- CVE-2026-34457OAuth2 Proxy: Health Check User-Agent Matching Bypasses Authentication in auth_request ModeGo · github.com/oauth2-proxy/oauth2-proxy, github.com/oauth2-proxy/oauth2-proxy/v7 · fixed in 7.15.2
- CVE-2026-34454OAuth2 Proxy: Session cookie not cleared when rendering sign-in pageGo · github.com/oauth2-proxy/oauth2-proxy, github.com/oauth2-proxy/oauth2-proxy/v7 · fixed in 7.15.2
- CVE-2026-34984External Secrets Operator has DNS exfiltration via getHostByName in its v2 template engineGo · github.com/external-secrets/external-secrets · fixed in 1.3.3-0.20260331202714-6800989bdc12
- CVE-2026-34476Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP ServerGo · github.com/apache/skywalking-mcp · fixed in 0.2.0
- CVE-2026-5724Missing Authentication on Streaming gRPC Replication EndpointGo · go.temporal.io/server · fixed in 1.28.4, 1.29.6, 1.30.4
- CVE-2026-40242Arcane Unauthenticated SSRF with Conditional Response Reflection in Template Fetch EndpointGo · github.com/getarcaneapp/arcane/backend · fixed in 1.17.3
- CVE-2026-40189goshs has a file-based ACL authorization bypass in goshs state-changing routesGo · github.com/patrickhener/goshs
- CVE-2026-40188goshs is Missing Write Protection for Parametric Data ValuesGo · github.com/patrickhener/goshs
- CVE-2026-40097Step CA affected by an index out of bounds panic in TPM attestation EKU validationGo · github.com/smallstep/certificates · fixed in 0.30.0