Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-40103Vikunja's Scoped API tokens with projects.background permission can delete project backgroundsGo · code.vikunja.io/api · fixed in 2.3.0
- CVE-2026-35602Vikunja has a File Size Limit Bypass via Vikunja ImportGo · code.vikunja.io/api · fixed in 2.3.0
- CVE-2026-35601Vikunja has an iCalendar Property Injection via CRLF in CalDAV Task OutputGo · code.vikunja.io/api · fixed in 2.3.0
- CVE-2026-35600Vikunja has HTML Injection via Task Titles in Overdue Email NotificationsGo · code.vikunja.io/api · fixed in 2.3.0
- CVE-2026-35599Vikunja has an Algorithmic Complexity DoS in Repeating Task HandlerGo · code.vikunja.io/api · fixed in 2.3.0
- CVE-2026-35598Vikunja has Missing Authorization on CalDAV Task ReadGo · code.vikunja.io/api · fixed in 2.3.0
- CVE-2026-35597Vikunja Affected by TOTP Brute-Force Due to Non-Functional Account LockoutGo · code.vikunja.io/api · fixed in 2.3.0
- CVE-2026-35596Vikunja has Broken Access Control on Label Read via SQL Operator Precedence BugGo · code.vikunja.io/api · fixed in 2.3.0
- CVE-2026-35595Vikunja Affected by Privilege Escalation via Project ReparentingGo · code.vikunja.io/api · fixed in 2.3.0
- CVE-2026-35594Vikunja Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgradeGo · code.vikunja.io/api · fixed in 2.3.0
- CVE-2026-34727Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login PathGo · code.vikunja.io/api · fixed in 2.3.0
- CVE-2026-5412Juju CloudSpec API could leak senstive informationGo · github.com/juju/juju · fixed in 0.0.0-20260408003526-d395054dc2c3
- CVE-2026-5774Juju API Server Denial of Service and Authentication Replay via Unsynchronized Token MapGo · github.com/juju/juju · fixed in 0.0.0-20260408003526-d395054dc2c3
- CVE-2026-40109Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggeringGo · github.com/fluxcd/notification-controller · fixed in 1.8.3
- CVE-2026-40107SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram RenderingGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260407035653-2f416e5253f1
- CVE-2026-35206Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segmentGo · helm.sh/helm/v3, helm.sh/helm/v4 · fixed in 3.20.2, 4.1.4
- CVE-2026-40077Beszel has an IDOR in hub API endpoints that read system ID from URL parameterGo · github.com/henrygd/beszel · fixed in 0.18.7
- CVE-2026-39961Aiven Operator has cross-namespace secret exfiltration via ClickhouseUser connInfoSecretSourceGo · github.com/aiven/aiven-operator · fixed in 0.37.0
- CVE-2026-39972Mercure has a Topic Selector Cache Key CollisionGo · github.com/dunglas/mercure · fixed in 0.22.0
- CVE-2026-35205Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin installGo · helm.sh/helm/v4 · fixed in 4.1.4
- CVE-2026-35204Helm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directoryGo · helm.sh/helm/v4 · fixed in 4.1.4
- CVE-2026-4660Go-getter may allow to arbitrary filesystem reads through git operationsGo · github.com/hashicorp/go-getter · fixed in 1.8.6
- CVE-2026-24661Unbounded Request Body Read in MS Teams Plugin {{/changes}} Webhook EndpointGo · github.com/mattermost/mattermost-plugin-msteams · fixed in 1.15.1-0.20260213190728-6fe4d295592e
- CVE-2026-21388Unbounded Request Body Read in MS Teams Plugin {{/lifecycle}} Webhook EndpointGo · github.com/mattermost/mattermost-plugin-msteams · fixed in 1.15.1-0.20260213190728-6fe4d295592e
- CVE-2026-34179Update of type field in restricted TLS certificate allows privilege escalation to cluster adminGo · github.com/canonical/lxd
- CVE-2026-34178Importing a crafted backup leads to project restriction bypassGo · github.com/canonical/lxd
- CVE-2026-34177VM lowlevel restriction bypass via raw.apparmor and raw.qemu.confGo · github.com/canonical/lxd
- CVE-2026-39901monetr: Protected Transactions Deletable via PUTGo · github.com/monetr/monetr · fixed in 1.12.3
- CVE-2026-39883OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijackingGo · go.opentelemetry.io/otel/sdk · fixed in 1.43.0
- CVE-2026-39882OpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodiesGo · go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp +1 · fixed in 0.19.0, 1.43.0