Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-84360Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration toolsGo · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260703131214-23d1934099b0
- CVE-2026-84316Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)Go · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260703131214-23d1934099b0
- CVE-2026-84319Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker contextGo · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260703131214-23d1934099b0
- CVE-2026-84317Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)Go · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260703131214-23d1934099b0
- CVE-2026-84313Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeoverGo · github.com/0xjacky/nginx-ui, nginx-ui · fixed in 1.9.10-0.20260703131214-23d1934099b0
- CVE-2026-84321Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enableGo · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260703131214-23d1934099b0
- CVE-2026-84314Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management EndpointGo · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260703131214-23d1934099b0
- CVE-2026-84320Nginx UI: Auto backup name allows path traversal outside validated storage pathGo · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260715121709-f92218e01054
- CVE-2026-84318Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCEGo · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260703131214-23d1934099b0
- CVE-2026-84315Nginx UI OTP secure-session step-up is missing on sensitive mutation routesGo · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260703131214-23d1934099b0
- CVE-2026-41508OWASP Coraza WAF: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handlingGo · github.com/corazawaf/coraza, github.com/corazawaf/coraza/v2 +1 · fixed in 3.8.0
- CVE-2026-41504OWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via request body and header fieldsGo · github.com/corazawaf/coraza, github.com/corazawaf/coraza/v2 +1 · fixed in 3.8.0
- CVE-2026-104774OWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF BypassGo · github.com/corazawaf/coraza, github.com/corazawaf/coraza/v2 +1 · fixed in 3.8.0
- CVE-2026-41510OWASP Coraza WAF: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter floodingGo · github.com/corazawaf/coraza, github.com/corazawaf/coraza/v2 +1 · fixed in 3.8.1
- CVE-2026-95838containerd: Unpack DoS via repeated opaque whiteoutsGo · github.com/containerd/containerd, github.com/containerd/containerd/v2 · fixed in 1.7.35, 2.0.12, 2.2.8 and more
- CVE-2026-95837containerd CRI plugin: Checkpoint restore bypasses destination security contextGo · github.com/containerd/containerd, github.com/containerd/containerd/v2 · fixed in 2.2.7, 2.3.4
- CVE-2026-102663OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve SearchGo · github.com/openlistteam/openlist, github.com/openlistteam/openlist/v3 +1 · fixed in 4.2.4
- CVE-2026-62376Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read accessGo · code.vikunja.io/api · fixed in 2.4.0
- CVE-2026-62367Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeoverGo · code.vikunja.io/api · fixed in 2.4.0
- CVE-2026-57458Vikunja: Scoped API token can mint unrestricted OAuth session credentialsGo · code.vikunja.io/api · fixed in 2.4.0
- CVE-2026-107840yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labelsGo · github.com/jhaals/yopass · fixed in 0.0.0-20260727191436-61e31ead04a4
- CVE-2026-107839ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of ServiceGo · github.com/luskaner/agelanserver/server · fixed in 1.8.2-0.20260809203301-1dd40166a593
- CVE-2026-107835OWASP Coraza WAF: Cookie Parser ConfusionGo · github.com/corazawaf/coraza, github.com/corazawaf/coraza/v2 +1 · fixed in 3.8.1
- CVE-2026-107834OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processorGo · github.com/corazawaf/coraza, github.com/corazawaf/coraza/v2 +1 · fixed in 3.8.0
- CVE-2026-107833OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustionGo · github.com/corazawaf/coraza, github.com/corazawaf/coraza/v2 +1 · fixed in 3.8.0
- CVE-2026-107826OWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)Go · github.com/corazawaf/coraza, github.com/corazawaf/coraza/v2 +1 · fixed in 3.8.1
- CVE-2026-107825OWASP Coraza WAF: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrationsGo · github.com/corazawaf/coraza, github.com/corazawaf/coraza/v2 +1 · fixed in 3.8.0
- CVE-2026-55797Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URLGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 +1 · fixed in 3.3.15, 3.4.10, 3.5.4 and more
- CVE-2026-107813Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-upGo · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260728074433-a3999bd78a3b
- CVE-2026-107812Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITMGo · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260728114330-580585516dd8