Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-33132ZITADEL is missing enforcement of organization scopesGo · github.com/zitadel/zitadel · fixed in 1.80.0-v2.20.0.20260317120401-d90285929ca0, 4.12.3, 3.4.9
- CVE-2026-32595Traefik: BasicAuth Middleware Timing Attack Allows Username EnumerationGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.41, 3.6.11, 3.7.0-ea.2
- CVE-2026-32305Traefik mTLS bypass via fragmented ClientHello SNI extraction failureGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.41, 3.6.11, 3.7.0-ea.2
- CVE-2026-33081PinchTab has Blind SSRF via browser-side redirect bypass in /download URL validationGo · github.com/pinchtab/pinchtab · fixed in 0.8.3
- CVE-2026-33067SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package MetadataGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260317012524-fe4523fff2c8
- CVE-2026-33066SiYuan has Stored XSS to RCE via Unsanitized Bazaar README RenderingGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260314111550-b382f50e1880
- CVE-2026-33192free5GC UDM incorrectly returns 500 for empty supi path parameter in PATCH sdm-subscriptions requesGo · github.com/free5gc/udm · fixed in 1.4.2
- CVE-2026-33065free5GC UDM incorrectly returns 500 for empty supi path parameter in DELETE sdm-subscriptions requestGo · github.com/free5gc/udm · fixed in 1.4.2
- CVE-2026-33064free5GC UDM DataChangeNotification Procedure Panic Due to Nil Pointer DereferenceGo · github.com/free5gc/udm · fixed in 1.4.2
- CVE-2026-33191free5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server ErrorGo · github.com/free5gc/udm · fixed in 1.4.2
- CVE-2026-33022Tekton Pipelines: Controller can panic when setting long resolver names in TaskRun/PipelineRunGo · github.com/tektoncd/pipeline · fixed in 1.0.1, 1.3.3, 1.6.1 and more
- CVE-2026-32768Chall-Manager's invalid NetworkPolicy enables a malicious actor to pivot into another namespaceGo · github.com/ctfer-io/chall-manager/deploy, github.com/ctfer-io/chall-manager/sdk · fixed in 0.6.5
- CVE-2026-32953Tillitis: TKey Client has an Error in Protocol ImplementationGo · github.com/tillitis/tkeyclient · fixed in 1.3.0
- CVE-2026-32941Sliver Vulnerable to Authenticated OOM via Memory Exhaustion in mTLS/WireGuard TransportsGo · github.com/bishopfox/sliver
- CVE-2026-32940SiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183)Go · github.com/siyuan-note/siyuan
- CVE-2026-32938SiYuan has an Arbitrary File Read in its Desktop Publish ServiceGo · github.com/siyuan-note/siyuan/kernel
- CVE-2026-33063free5GC AUSF UE Authentication Panic on Nil SuciSupiMap Interface ConversionGo · github.com/free5gc/ausf · fixed in 1.4.2
- CVE-2026-33062free5GC NRF Discovery EncodeGroupId Function Panics on Malformed group-id-list ParameterGo · github.com/free5gc/nrf · fixed in 1.4.2
- CVE-2026-32937free5GC CHF has Out-of-Bounds Slice Access that Leads to DoSGo · github.com/free5gc/chf · fixed in 1.2.2
- CVE-2026-32811Heimdall: Path received via Envoy gRPC corrupted when containing query stringGo · github.com/dadrus/heimdall · fixed in 0.17.11
- CVE-2026-32828Kargo: SSRF in Promotion http/http-download Steps Enables Internal Network Access and Data ExfiltrationGo · github.com/akuity/kargo · fixed in 1.6.4, 1.7.9, 1.8.12 and more
- CVE-2026-32771Monitoring is vulnerable to Archive Slip due to missing checks in sanitizationGo · github.com/ctfer-io/monitoring · fixed in 0.2.2
- CVE-2026-32769Fullchain's Invalid NetworkPolicy enables a malicious actor to pivot into another namespaceGo · github.com/ctfer-io/fullchain · fixed in 0.1.1
- CVE-2026-32767SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search APIGo · github.com/siyuan-note/siyuan/kernel
- CVE-2026-32761File Browser has an Authorization Policy Bypass in its Public Share Download FlowGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 +1 · fixed in 2.62.0
- CVE-2026-32760File Browser Self Registration Grants Any User Admin Access When Default Permissions Include AdminGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.62.0
- CVE-2026-32759File Browser TUS Negative Upload-Length Fires Post-Upload Hooks PrematurelyGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.33.8
- CVE-2026-32758File Browser has an Access Rule Bypass via Path Traversal in Copy/Rename Destination ParameterGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.62.0
- CVE-2026-4342ingress-nginx comment-based nginx configuration injectionGo · k8s.io/ingress-nginx · fixed in 0.0.0-20260319175635-5183b7d86137
- CVE-2026-32815SiYuan: Cross-Origin WebSocket Hijacking via Authentication Bypass — Unauthenticated Information DisclosureGo · github.com/siyuan-note/siyuan/kernel