Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-32287Infinite loop in github.com/antchfx/xpathGo · github.com/antchfx/xpath · fixed in 1.3.6
- CVE-2026-32286Denial of service in github.com/jackc/pgproto3/v2Go · github.com/jackc/pgproto3/v2
- CVE-2026-32285Denial of service in github.com/buger/jsonparserGo · github.com/buger/jsonparser · fixed in 1.1.2
- CVE-2026-32284Denial of service in github.com/shamaton/msgpackGo · github.com/shamaton/msgpack, github.com/shamaton/msgpack/v2 +1 · fixed in 2.4.1, 3.1.1
- CVE-2026-33529Zoraxy: Authenticated Path Traversal in Config Import leads to RCEGo · github.com/tobychui/zoraxy · fixed in 3.3.2, 3.3.2+incompatible
- CVE-2026-33528GoDoxy has a Path Traversal Vulnerability in its File APIGo · github.com/yusing/godoxy · fixed in 0.27.5
- CVE-2026-33525Authelia: Improper Neutralization of Input During Web Page Generation Leads to Potential Cross-site ScriptingGo · github.com/authelia/authelia, github.com/authelia/authelia/v4 · fixed in 4.39.16
- CVE-2026-33505Ory Keto has a SQL injection via forged pagination tokensGo · github.com/ory/keto · fixed in 0.14.1-0.20260320140104-e4393662cd2e
- CVE-2026-33504Ory Hydra has a SQL injection via forged pagination tokensGo · github.com/ory/hydra, github.com/ory/hydra/v2 · fixed in 2.3.1-0.20260320110106-0b84568fffcc
- CVE-2026-33503Ory Kratos has a SQL injection via forged pagination tokensGo · github.com/ory/kratos · fixed in 1.3.1-0.20260320110106-9d7085948039
- CVE-2026-33496Ory Oathkeeper has an authentication bypass by cache key confusionGo · github.com/ory/oathkeeper · fixed in 0.40.10-0.20260320084801-198a2bc82a99
- CVE-2026-33495Ory Oathkeeper has an authentication bypass by usage of untrusted headerGo · github.com/ory/oathkeeper · fixed in 0.40.10-0.20260320084810-e9acca14a04d
- CVE-2026-33494Ory Oathkeeper has a path traversal authorization bypassGo · github.com/ory/oathkeeper · fixed in 0.40.10-0.20260320084758-8e0002140491
- CVE-2026-33487goxmldsig has validateSignature Loop Variable Capture Signature BypassGo · github.com/russellhaering/goxmldsig · fixed in 1.6.0
- CVE-2026-33481Syft improper temporary file cleanupGo · github.com/anchore/syft · fixed in 1.42.3
- CVE-2026-3112Arbitrary File Read via Advanced Logging Support PacketGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.12+incompatible, 11.2.4+incompatible, 11.3.2+incompatible and more
- CVE-2026-3115Guest users can view group member IDs without respecting view restrictionsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.11+incompatible, 11.2.3+incompatible, 11.3.2+incompatible and more
- CVE-2026-3114Zip Bomb Denial of Service via Unrestricted Archive DecompressionGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.12+incompatible, 11.2.4+incompatible, 11.3.2+incompatible and more
- CVE-2026-3113mmctl export download command doesn’t restrict permissions to created file to file ownerGo · github.com/mattermost/mattermost-server · fixed in 10.11.12+incompatible, 11.2.4+incompatible, 11.3.2+incompatible and more
- CVE-2026-3108Terminal Escape Injection in mmctl Report Posts CommandGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.11+incompatible, 11.2.3+incompatible, 11.3.2+incompatible and more
- CVE-2026-33413etcd: Authorization bypasses in multiple APIsGo · go.etcd.io/etcd, go.etcd.io/etcd/v3 · fixed in 3.6.9, 3.5.28, 3.4.42
- CVE-2026-33343etcd: Nested etcd transactions bypass RBAC authorization checksGo · go.etcd.io/etcd, go.etcd.io/etcd/v3 · fixed in 3.4.42, 3.5.28, 3.6.9
- CVE-2026-4274Insufficient authorization in shared channel membership sync grants team-level access instead of channel-level accessGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.11+incompatible, 11.2.3+incompatible, 11.3.2+incompatible and more
- CVE-2026-33249NATS: Message tracing can be redirected to arbitrary subjectGo · github.com/nats-io/nats-server, github.com/nats-io/nats-server/v2 · fixed in 2.11.15, 2.12.6
- CVE-2026-33223NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity SpoofingGo · github.com/nats-io/nats-server, github.com/nats-io/nats-server/v2 · fixed in 2.11.15, 2.12.6
- CVE-2026-33248NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matchingGo · github.com/nats-io/nats-server, github.com/nats-io/nats-server/v2 · fixed in 2.11.15, 2.12.6
- CVE-2026-33222NATS JetStream has an authorization bypass through its Management APIGo · github.com/nats-io/nats-server, github.com/nats-io/nats-server/v2 · fixed in 2.11.15, 2.12.6
- CVE-2026-33247NATS credentials are exposed in monitoring port via command-line argvGo · github.com/nats-io/nats-server, github.com/nats-io/nats-server/v2 · fixed in 2.11.15, 2.12.6
- CVE-2026-33219NATS is vulnerable to pre-auth DoS through WebSockets client serviceGo · github.com/nats-io/nats-server, github.com/nats-io/nats-server/v2 · fixed in 2.11.15, 2.12.6
- CVE-2026-33218NATS has pre-auth server panic via leafnode handlingGo · github.com/nats-io/nats-server, github.com/nats-io/nats-server/v2 · fixed in 2.11.15, 2.12.6