Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-34386Fleet vulnerable to SQL injection in MDM bootstrap package by authenticated team or global adminGo · github.com/fleetdm/fleet/v4 · fixed in 4.81.0
- CVE-2026-34385Fleet's Apple MDM profile delivery has second-order SQL injection that can compromise the databaseGo · github.com/fleetdm/fleet/v4 · fixed in 4.81.0
- CVE-2026-29180Fleet's team maintainer can transfer hosts from any team via missing source team authorizationGo · github.com/fleetdm/fleet/v4 · fixed in 4.81.1
- CVE-2026-26061Fleet's unbounded request body read allows remote Denial of ServiceGo · github.com/fleetdm/fleet/v4 · fixed in 4.43.5-0.20260113202849-bbc1aef2987d
- CVE-2026-26060Fleet: Password reset tokens remain valid after password change for 24 hoursGo · github.com/fleetdm/fleet/v4 · fixed in 4.43.5-0.20260113202849-bbc1aef2987d
- CVE-2026-33758OpenBao has Reflected XSS in its OIDC authentication error messageGo · github.com/openbao/openbao · fixed in 0.0.0-20260325133417-6e2b2dd84f0e
- CVE-2026-33757OpenBao lacks user confirmation for OIDC direct callback modeGo · github.com/openbao/openbao · fixed in 0.0.0-20260325142553-e32103951925
- CVE-2026-27877Public dashboards discloses all direct mode datasourcesGo · github.com/grafana/grafana · fixed in 1.9.2-0.20260325055210-3522153e07b4
- CVE-2026-33748BuildKit Git URL subdir component can cause access to restricted filesGo · github.com/moby/buildkit · fixed in 0.28.1
- CVE-2026-33433Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerFieldGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.42, 3.6.12, 3.7.0-ea.3
- CVE-2026-32695Traefik has Knative Ingress Rule Injection that Allows Host Restriction BypassGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 3.6.11, 3.7.0-ea.2
- CVE-2026-33747BuildKit vulnerable to malicious frontend causing file escape outside of storage rootGo · github.com/moby/buildkit · fixed in 0.28.1
- CVE-2026-33729OpenFGA has an Authorization Bypass through cached keysGo · github.com/openfga/openfga · fixed in 1.13.1
- CVE-2026-33726Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node trafficGo · github.com/cilium/cilium · fixed in 1.17.14, 1.18.8, 1.19.2
- CVE-2026-33945Abitrary file write through systemd-creds optionGo · github.com/lxc/incus, github.com/lxc/incus/v6 · fixed in 6.23.0
- CVE-2026-33898Local Incus UI web server vulnerable to nuthentication bypassGo · github.com/lxc/incus, github.com/lxc/incus/v6 +1 · fixed in 6.23.0
- CVE-2026-33897Incus vulnerable to arbitrary file read and write through pongo templatesGo · github.com/lxc/incus, github.com/lxc/incus/v6 · fixed in 6.23.0
- CVE-2026-33743Incus vulnerable to denial of source through crafted bucket backup fileGo · github.com/lxc/incus, github.com/lxc/incus/v6 · fixed in 6.23.0
- CVE-2026-33711Incus vulnerable to local privilege escalation through VM screenshot pathGo · github.com/lxc/incus, github.com/lxc/incus/v6 · fixed in 6.23.0
- CVE-2026-33542Incus does not verify combined fingerprint when downloading images from simplestreams serversGo · github.com/lxc/incus, github.com/lxc/incus/v6 +1 · fixed in 6.23.0
- CVE-2026-28377S3 SSE-C Encryption Key Exposed in Plaintext via Config Endpoint (CVE-2025-41118 Pattern)Go · github.com/grafana/tempo · fixed in 2.10.3
- CVE-2026-33670SiYuan has directory traversal within its publishing serviceGo · github.com/siyuan-note/siyuan/kernel
- CVE-2026-33669SiYuan has Arbitrary Document Reading within the Publishing ServiceGo · github.com/siyuan-note/siyuan/kernel
- CVE-2026-33638Ech0 authenticated user-list exposed data via public `/api/allusers` endpointGo · github.com/lin-snow/ech0 · fixed in 1.4.8-0.20260322121226-acbf1fd71011
- CVE-2026-33623PinchTab: OS Command Injection via Profile Name in Windows Cleanup Routine Enables Arbitrary Command ExecutionGo · github.com/pinchtab/pinchtab, github.com/pinchtab/pinchtab/cmd/pinchtab · fixed in 0.8.5
- CVE-2026-33622A PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript ExecutionGo · github.com/pinchtab/pinchtab, github.com/pinchtab/pinchtab/cmd/pinchtab
- CVE-2026-33621PinchTab: Unapplied Rate Limiting Middleware Allows Unbounded Brute-Force of API TokenGo · github.com/pinchtab/pinchtab · fixed in 0.8.5
- CVE-2026-33620PinchTab: API Bearer Token Exposed in URL Query Parameter via Server Logs and Intermediary SystemsGo · github.com/pinchtab/pinchtab · fixed in 0.8.4
- CVE-2026-33619PinchTab has Unauthenticated Blind SSRF in Task Scheduler via Unvalidated callbackUrlGo · github.com/pinchtab/pinchtab · fixed in 0.8.4
- CVE-2026-21724Missing Protected-field Authorization in Provisioning Contact Points APIGo · github.com/grafana/grafana · fixed in 1.9.2-0.20260323180334-daffe750de85