Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-39429kcp's cache server is accessible without authentication or authorization checksGo · github.com/kcp-dev/kcp · fixed in 0.29.3, 0.30.3
- CVE-2026-39414MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV ParsingGo · github.com/minio/minio
- CVE-2026-27806Fleet Affected by Local Privilege Escalation via Tcl Command Injection in OrbitGo · github.com/fleetdm/fleet/v4 · fixed in 4.81.1
- CVE-2026-32280Unexpected work during chain building in crypto/x509Go · stdlib · fixed in 1.25.9, 1.26.2
- CVE-2026-32281Inefficient policy validation in crypto/x509Go · stdlib · fixed in 1.25.9, 1.26.2
- CVE-2026-27140Code execution vulnerability in SWIG code generation in cmd/goGo · toolchain · fixed in 1.25.9, 1.26.2
- CVE-2026-32283Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tlsGo · stdlib · fixed in 1.25.9, 1.26.2
- CVE-2026-32288Unbounded allocation for old GNU sparse in archive/tarGo · stdlib · fixed in 1.25.9, 1.26.2
- CVE-2026-27143Missing bound checks can lead to memory corruption in safe Go in cmd/compileGo · toolchain · fixed in 1.25.9, 1.26.2
- CVE-2026-27144Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compileGo · toolchain · fixed in 1.25.9, 1.26.2
- CVE-2026-33810Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509Go · stdlib · fixed in 1.26.2
- CVE-2026-32289JsBraceDepth Context Tracking Bugs (XSS) in html/templateGo · stdlib · fixed in 1.25.9, 1.26.2
- CVE-2026-32282TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unixGo · stdlib · fixed in 1.25.9, 1.26.2
- CVE-2026-39846SiYuan affected by Remote Code Execution in the Electron desktop client via stored XSS in synced table captionsGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260407035653-2f416e5253f1
- CVE-2026-29181OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)Go · go.opentelemetry.io/otel · fixed in 1.41.0
- CVE-2026-39395Cosign's verify-blob-attestation reports false positive when payload parsing failsGo · github.com/sigstore/cosign, github.com/sigstore/cosign/v2 +1 · fixed in 3.0.6, 2.6.3
- CVE-2026-35607File Browser: Proxy auth auto-provisioned users inherit Execute permission and CommandsGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.63.1
- CVE-2026-35606File Browser discloses text file content via /api/resources endpoint bypassing Perm.Download checkGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.63.1
- CVE-2026-35605File Browser has an access rule bypass via HasPrefix without trailing separator in path matchingGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.63.1
- CVE-2026-35604File Browser share links remain accessible after Share/Download permissions are revokedGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.63.1
- CVE-2026-35585File Browser has a Command Injection via Hook RunnerGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.33.8
- CVE-2026-33816CVE-2026-33816 in github.com/jackc/pgxGo · github.com/jackc/pgx/v5 · fixed in 5.9.0
- CVE-2026-33815CVE-2026-33815 in github.com/jackc/pgxGo · github.com/jackc/pgx/v5 · fixed in 5.9.0
- CVE-2026-35480go-ipld-prime's DAG-CBOR decoder unbounded memory allocation from CBOR headersGo · github.com/ipld/go-ipld-prime · fixed in 0.22.0
- CVE-2026-4740Rhacm: open cluster management (ocm): cross-cluster privilege escalation via improper kubernetes client certificate renewal validationGo · open-cluster-management.io/ocm · fixed in 1.2.1
- CVE-2026-35458Gotenberg has a ReDoS via extraHttpHeaders scope featureGo · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8 · fixed in 8.30.0
- CVE-2026-35454Code Extension Marketplace has a Zip Slip Path TraversalGo · github.com/coder/code-marketplace · fixed in 1.2.3-0.20260402184705-988440dee05f
- CVE-2026-35471Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshsGo · github.com/patrickhener/goshs · fixed in 1.1.5-0.20260401172448-237f3af891a9
- CVE-2026-35393Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart uploadGo · github.com/patrickhener/goshs · fixed in 1.1.5-0.20260401172448-237f3af891a9
- CVE-2026-35392goshs has an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT UploadGo · github.com/patrickhener/goshs · fixed in 1.1.5-0.20260401172448-237f3af891a9