Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-33990Docker Model Runner OCI Registry Client Vulnerable to Server-Side Request Forgery (SSRF)Go · github.com/docker/model-runner · fixed in 1.1.25
- CVE-2026-4370Improper TLS Client/Server authentication and certificate verification on Database ClusterGo · github.com/juju/juju
- CVE-2026-34605SiYuan: Reflected XSS via SVG namespace prefix bypass in SanitizeSVG ( getDynamicIcon, unauthenticated )Go · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260330031106-f09953afc57a
- CVE-2026-34585SiYuan: Stored XSS in imported .sy.zip content leads to arbitrary command executionGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260329142331-918d1bd9f967
- CVE-2026-34449SiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet InjectionGo · github.com/siyuan-note/siyuan/kernel · fixed in 3.6.2
- CVE-2026-34448SiYuan: Stored XSS in Attribute View gallery/kanban cover rendering allows arbitrary command execution in the desktop clientGo · github.com/siyuan-note/siyuan/kernel · fixed in 3.6.2
- CVE-2026-34453SiYuan: Broken access control in /api/bookmark/getBookmark allows unauthenticated publish visitors to read password-protected bookmarked contentGo · github.com/siyuan-note/siyuan/kernel · fixed in 3.6.2
- CVE-2026-34204MinIO is Vulnerable to SSE Metadata Injection via Replication HeadersGo · github.com/minio/minio
- CVE-2026-34227Sliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP InterfaceGo · github.com/bishopfox/sliver · fixed in 1.7.4
- CVE-2026-33762go-git: Missing validation decoding Index v4 files leads to panicGo · github.com/go-git/go-git, github.com/go-git/go-git/v4 +1 · fixed in 5.17.1
- CVE-2026-34165go-git: Maliciously crafted idx file can cause asymmetric memory consumptionGo · github.com/go-git/go-git, github.com/go-git/go-git/v4 +1 · fixed in 5.17.1
- CVE-2026-34042act: actions/cache server allows malicious cache injectionGo · github.com/nektos/act · fixed in 0.2.86
- CVE-2026-34041act: Unrestricted set-env and add-path command processing enables environment injectionGo · github.com/nektos/act · fixed in 0.2.86
- CVE-2026-33997Moby: Off-by-one error in plugin privilege validationGo · github.com/docker/docker, github.com/moby/moby +1 · fixed in 2.0.0-beta.8
- CVE-2026-34040Moby: AuthZ plugin bypass with oversized request bodyGo · github.com/docker/docker, github.com/moby/moby +1 · fixed in 29.3.1, 2.0.0-beta.8
- CVE-2026-4789CVE-2026-4789Go · github.com/kyverno/kyverno · fixed in 1.17.0
- CVE-2026-27018Gotenberg: Chromium deny-list bypass via case-insensitive URL schemeGo · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8 · fixed in 8.29.0
- CVE-2026-33026nginx-ui Backup Restore Allows Tampering with Encrypted BackupsGo · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260315015203-f61bcec547c0
- CVE-2026-33027Nginx UI: Improper Path Validation Allows Recursive Deletion of the Nginx Configuration DirectoryGo · github.com/0xjacky/nginx-ui
- CVE-2026-33028Nginx UI: Race Condition Leads to Persistent Data Corruption and Service CollapseGo · github.com/0xjacky/nginx-ui, github.com/uozi-tech/cosy · fixed in 1.30.1
- CVE-2026-33029Nginx UI: DoS via Negative Integer Input in Logrotate IntervalGo · github.com/0xjacky/nginx-ui
- CVE-2026-33030Nginx UI: Unencrypted Storage of DNS API Tokens and ACME Private KeysGo · github.com/0xjacky/nginx-ui
- CVE-2026-33032Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx TakeoverGo · github.com/0xjacky/nginx-ui
- CVE-2026-33907Ella Core Panics during NAS Authentication Response/Failure with missing IEsGo · github.com/ellanetworks/core · fixed in 1.7.0
- CVE-2026-33906Ella Core has Privilege Escalation via Database Restore by NetworkManager roleGo · github.com/ellanetworks/core · fixed in 1.7.0
- CVE-2026-33904Ella Core has a Denial of Service via SCTP connection cleanup deadlockGo · github.com/ellanetworks/core · fixed in 1.7.0
- CVE-2026-33903Ella Core panics when processing a crafted NGAP LocationReport messageGo · github.com/ellanetworks/core · fixed in 1.7.0
- CVE-2026-32241Flannel vulnerable to cross-node remote code execution via extension backend BackendData injectionGo · github.com/flannel-io/flannel · fixed in 0.28.2
- CVE-2026-34389Fleet's user account creation via invite does not enforce invited email addressGo · github.com/fleetdm/fleet/v4 · fixed in 4.81.0
- CVE-2026-34388Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpointGo · github.com/fleetdm/fleet/v4 · fixed in 4.81.0