Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-33246NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headersGo · github.com/nats-io/nats-server, github.com/nats-io/nats-server/v2 · fixed in 2.11.15, 2.12.6
- CVE-2026-33217NATS allows MQTT clients to bypass ACL checksGo · github.com/nats-io/nats-server, github.com/nats-io/nats-server/v2 · fixed in 2.11.15, 2.12.6
- CVE-2026-33216NATS has MQTT plaintext password disclosureGo · github.com/nats-io/nats-server, github.com/nats-io/nats-server/v2 · fixed in 2.11.15, 2.12.6
- CVE-2026-29785NATS Server panic via malicious compression on leafnode portGo · github.com/nats-io/nats-server, github.com/nats-io/nats-server/v2 · fixed in 2.11.14, 2.12.5
- CVE-2026-27889NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsReadGo · github.com/nats-io/nats-server, github.com/nats-io/nats-server/v2 · fixed in 2.11.14, 2.12.5
- CVE-2026-33809OOM from malicious IFD offset in golang.org/x/image/tiffGo · golang.org/x/image · fixed in 0.38.0
- CVE-2026-27659CSRF vulnerability in UpdateAccessControlPolicyActiveStatus endpointGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.11+incompatible, 11.2.3+incompatible, 11.3.2+incompatible and more
- CVE-2026-20719DoS via URL Previews Rendering Malicious SVGsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.2+incompatible, 11.2.4+incompatible, 11.3.2+incompatible and more
- CVE-2026-27656Account Takeover via Substring Matching in OpenID Connect AuthenticationGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 11.4.1, 11.3.2, 11.2.4 and more
- CVE-2026-26233Denial of Service via HTTP/2 single packet attack on login endpointGo · github.com/mattermost/mattermost-server · fixed in 10.11.12+incompatible, 11.2.4+incompatible, 11.3.2+incompatible and more
- CVE-2026-33215NATS is vulnerable to MQTT hijacking via Client IDGo · github.com/nats-io/nats-server, github.com/nats-io/nats-server/v2 · fixed in 2.11.15, 2.12.6
- CVE-2026-33353Soft Serve: Authenticated repo import can clone server-local private repositoriesGo · github.com/charmbracelet/soft-serve · fixed in 0.11.6
- CVE-2026-33344Dagu has an incomplete fix for CVE-2026-27598: path traversal via %2F-encoded slashes in locateDAGGo · github.com/dagu-org/dagu · fixed in 1.30.4-0.20260319093346-7d07fda8f9de
- CVE-2026-33419MinIO: LDAP login brute-force via user enumeration and missing rate limitGo · github.com/minio/minio
- CVE-2026-33322MinIO: JWT Algorithm Confusion in OIDC AuthenticationGo · github.com/minio/minio
- CVE-2026-33700Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share DeletionGo · code.vikunja.io/api · fixed in 2.2.1
- CVE-2026-33680Vikunja Vulnerable to Link Share Hash Disclosure via ReadAll Endpoint Enables Permission EscalationGo · code.vikunja.io/api · fixed in 2.2.2
- CVE-2026-33679Vikunja has SSRF via OpenID Connect Avatar Download that Bypasses Webhook SSRF ProtectionsGo · code.vikunja.io/api · fixed in 2.2.1
- CVE-2026-33678Vikunja has IDOR in Task Attachment ReadOne Allows Cross-Project File Access and DeletionGo · code.vikunja.io/api · fixed in 2.2.1
- CVE-2026-33677Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via APIGo · code.vikunja.io/api · fixed in 2.2.1
- CVE-2026-33676Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task ReadGo · code.vikunja.io/api · fixed in 2.2.1
- CVE-2026-33675Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network ResourcesGo · code.vikunja.io/api · fixed in 2.2.1
- CVE-2026-33668Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID ConnectGo · code.vikunja.io/api · fixed in 2.2.1
- CVE-2026-33474Vikunja Affected by DoS via Image Preview GenerationGo · code.vikunja.io/api · fixed in 2.2.0
- CVE-2026-33473Vikunja has TOTP Reuse During Validity WindowGo · code.vikunja.io/api
- CVE-2026-33316Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account DisablementGo · code.vikunja.io/api
- CVE-2026-33315Vikunja has a 2FA Bypass via Caldav Basic AuthGo · code.vikunja.io/api
- CVE-2026-33313Vikunja has an IDOR in Task Comments Allows Reading Arbitrary CommentsGo · code.vikunja.io/api
- CVE-2026-33320Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of serviceGo · github.com/tomwright/dasel, github.com/tomwright/dasel/v2 +1 · fixed in 3.3.2
- CVE-2026-33211Tekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver podGo · github.com/tektoncd/pipeline · fixed in 1.0.1, 1.3.3, 1.6.1 and more