Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-34972OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collisionGo · github.com/openfga/openfga · fixed in 1.14.0
- CVE-2026-35172Distribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidationGo · github.com/distribution/distribution, github.com/distribution/distribution/v3 · fixed in 3.1.0
- CVE-2026-35166Hugo does not properly escape some Markdown linksGo · github.com/gohugoio/hugo · fixed in 0.159.2
- CVE-2026-35037Ech0 affected by unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadataGo · github.com/lin-snow/ech0 · fixed in 1.4.8-0.20260401031029-4ca56fea5ba4
- CVE-2026-35036Ech0 Affected by Unauthenticated Server-Side Request Forgery in Website Preview FeatureGo · github.com/lin-snow/ech0 · fixed in 1.4.8-0.20260401031029-4ca56fea5ba4
- CVE-2026-34992Missing Encryption of Sensitive Data in antrea.io/antreaGo · antrea.io/antrea · fixed in 1.11.0-alpha.0.0.20260225185322-738bad662b20
- CVE-2026-34986Go JOSE affect by a panic in JWE decryptionGo · github.com/go-jose/go-jose, github.com/go-jose/go-jose/v3 +1 · fixed in 3.0.5, 4.1.4
- CVE-2026-34976Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing AuthorizationGo · github.com/dgraph-io/dgraph, github.com/dgraph-io/dgraph/v24 +2 · fixed in 25.3.1, 24.1.6
- CVE-2026-34783Ferret has a Path Traversal in IO::FS::WRITE allows arbitrary file write when scraping malicious websitesGo · github.com/montferret/ferret, github.com/montferret/ferret/v2 · fixed in 2.0.0-alpha.4
- CVE-2026-34969Nhost Leaks the Refresh Token via URL Query Parameter in OAuth Provider CallbackGo · github.com/nhost/nhost · fixed in 0.0.0-20260330133707-294954e0fc3a
- CVE-2026-34940KubeAI has an OS Command Injection via Model URL in Ollama Engine startup probe allows arbitrary command execution in model podsGo · github.com/kubeai-project/kubeai · fixed in 0.23.2
- CVE-2026-33540Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realmGo · github.com/distribution/distribution, github.com/distribution/distribution/v3 · fixed in 3.1.0
- CVE-2026-25726Cloudreve is vulnerable to Account Takeover via Weak Cryptographic Token Generation (Insecure PRNG Seeding)Go · github.com/cloudreve/cloudreve, github.com/cloudreve/cloudreve/v3 +1 · fixed in 4.0.0-20260205113604-ec9fdd33bc54
- CVE-2025-68153Juju: Resource poisoningGo · github.com/juju/juju · fixed in 0.0.0-20260120044552-26ff93c903d5
- CVE-2025-68152Juju: Read All Controller Logs From Compromised WorkloadGo · github.com/juju/juju · fixed in 0.0.0-20250623030540-c91a1f404695
- CVE-2026-5469Casdoor Webhook URL server-side request forgeryGo · github.com/casdoor/casdoor
- CVE-2026-5468Casdoor dangerouslySetInnerHTML cross site scriptingGo · github.com/casdoor/casdoor
- CVE-2026-28736Focalboard IDOR in file content endpoint allows cross-user file access (unsupported product, no fix)Go · github.com/mattermost/focalboard
- CVE-2026-25773Focalboard Second-Order SQL Injection in category reorder endpoint allows data exfiltration (unsupported product, no fix)Go · github.com/mattermost/focalboard
- CVE-2026-5467Casdoor OAuth Authorization Request redirectGo · github.com/casdoor/casdoor
- CVE-2026-34762Ella Core Has Audit Log Falsification via Path/Body IMSI Mismatch in UpdateSubscriberGo · github.com/ellanetworks/core · fixed in 1.8.0
- CVE-2026-34761Ella Core Panics Upon NGAP handover failureGo · github.com/ellanetworks/core · fixed in 1.8.0
- CVE-2026-34742Model Context Protocol Go SDK: DNS Rebinding Protection Disabled by Default for Servers Running on LocalhostGo · github.com/modelcontextprotocol/go-sdk · fixed in 1.4.0
- CVE-2026-34581goshs has Auth Bypass via Share TokenGo · github.com/patrickhener/goshs
- CVE-2026-34828listmonk: Active sessions remain valid after password reset and password changeGo · github.com/knadh/listmonk · fixed in 1.1.1-0.20260329113754-1b5e8d38c778
- CVE-2026-33544Tinyauth has OAuth account confusion via shared mutable state on singleton service instancesGo · github.com/steveiliop56/tinyauth · fixed in 1.0.1-0.20260401140714-fc1d4f2082a5
- CVE-2026-34530File Browser is vulnerable to Stored Cross-Site Scripting via text/template branding injectionGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.62.2
- CVE-2026-34528File Browser's Signup Grants Execution Permissions When Default Permissions Includes ExecutionGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.62.2
- CVE-2026-34529File Browser is vulnerable to Stored Cross-site Scripting via crafted EPUB fileGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.62.2
- CVE-2026-5199Cross Namespace Access via Batch OperationGo · go.temporal.io/server · fixed in 1.29.5, 1.30.3