Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-33678Vikunja has IDOR in Task Attachment ReadOne Allows Cross-Project File Access and DeletionGo · code.vikunja.io/api · fixed in 2.2.1
- CVE-2026-33677Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via APIGo · code.vikunja.io/api · fixed in 2.2.1
- CVE-2026-33676Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task ReadGo · code.vikunja.io/api · fixed in 2.2.1
- CVE-2026-33675Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network ResourcesGo · code.vikunja.io/api · fixed in 2.2.1
- CVE-2026-33668Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID ConnectGo · code.vikunja.io/api · fixed in 2.2.1
- CVE-2026-33474Vikunja Affected by DoS via Image Preview GenerationGo · code.vikunja.io/api · fixed in 2.2.0
- CVE-2026-33473Vikunja has TOTP Reuse During Validity WindowGo · code.vikunja.io/api
- CVE-2026-33316Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account DisablementGo · code.vikunja.io/api
- CVE-2026-33315Vikunja has a 2FA Bypass via Caldav Basic AuthGo · code.vikunja.io/api
- CVE-2026-33313Vikunja has an IDOR in Task Comments Allows Reading Arbitrary CommentsGo · code.vikunja.io/api
- CVE-2026-33320Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of serviceGo · github.com/tomwright/dasel, github.com/tomwright/dasel/v2 +1 · fixed in 3.3.2
- CVE-2026-33211Tekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver podGo · github.com/tektoncd/pipeline · fixed in 1.0.1, 1.3.3, 1.6.1 and more
- CVE-2026-33283Ella Core panics on malformed ULNASTransport Message without a Request TypeGo · github.com/ellanetworks/core · fixed in 1.6.0
- CVE-2026-33282Ella Core panics on malformed NGAP Location ReportGo · github.com/ellanetworks/core · fixed in 1.6.0
- CVE-2026-33281Ella Core panics on invalid PDU Session IDs in NGAP messagesGo · github.com/ellanetworks/core · fixed in 1.6.0
- CVE-2026-33252MCP Go SDK Allows Cross-Site Tool Execution for HTTP Servers without AuthorizatrionGo · github.com/modelcontextprotocol/go-sdk · fixed in 1.4.1
- CVE-2026-33634Trivy ecosystem supply chain briefly compromisedGo · github.com/aquasecurity/trivy
- CVE-2026-32879New API has passkey-based secure step-up verification bypass for root-only channel secret disclosureGo · github.com/quantumnous/new-api
- CVE-2026-30886New API: IDOR in VideoProxy allows cross-user video content access via missing ownership checkGo · github.com/quantumnous/new-api · fixed in 0.11.4-alpha.2
- CVE-2026-4404Use of hard coded credentials in GoHarbor HarborGo · github.com/goharbor/harbor
- CVE-2026-24516A command injection vulnerability exists in DigitalOcean Droplet Agent through 1.3.2.Go · github.com/digitalocean/droplet-agent
- CVE-2026-4531Free5GC AMF handler.go HandleRegistrationComplete denial of serviceGo · github.com/free5gc/amf · fixed in 1.4.3-0.20260306074636-52e9386401ce
- CVE-2026-33221Nhost Storage Affected by MIME Type Spoofing via Trusted Client Content-Type Header in Storage UploadGo · github.com/nhost/nhost · fixed in 0.0.0-20260318074820-c4bd53f042d7
- CVE-2026-33476SiYuan has an Unauthenticated Arbitrary File Read via Path TraversalGo · github.com/siyuan-note/siyuan/kernel
- CVE-2026-33203SiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive BypassGo · github.com/siyuan-note/siyuan/kernel · fixed in 3.6.2
- CVE-2026-33194SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /homeGo · github.com/siyuan-note/siyuan/kernel · fixed in 3.6.2
- CVE-2026-33186gRPC-Go has an authorization bypass via missing leading slash in :pathGo · google.golang.org/grpc · fixed in 1.79.3
- CVE-2026-3864CSI Driver for NFS path traversal via subDir may delete unintended directories on the NFS serverGo · github.com/kubernetes-csi/csi-driver-nfs · fixed in 0.0.0-20260210055231-316af2d86b91
- CVE-2026-33312Read-only Vikunja users can delete project background images via broken object-level authorizationGo · code.vikunja.io/api · fixed in 2.2.0
- CVE-2026-29794Vikunja has Rate-Limit Bypass for Unauthenticated Users via Spoofed HeadersGo · code.vikunja.io/api · fixed in 2.2.0