Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-32750SiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notesGo · github.com/siyuan-note/siyuan
- CVE-2026-32751SiYuan Vulnerable to Remote Code Execution via Stored XSS in Notebook Name - Mobile InterfaceGo · github.com/siyuan-note/siyuan/kernel
- CVE-2026-32749SiYuan importSY/importZipMd: Path Traversal via multipart filename enables arbitrary file writeGo · github.com/siyuan-note/siyuan/kernel
- CVE-2026-32747SiYuan: Incomplete sensitive path blocklist in globalCopyFiles allows reading /proc and Docker secretsGo · github.com/siyuan-note/siyuan/kernel
- CVE-2026-30924qui CORS Misconfiguration: Arbitrary Origins TrustedGo · github.com/autobrr/qui · fixed in 1.15.0
- CVE-2026-30836Step CA: Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18)Go · github.com/smallstep/certificates · fixed in 0.30.0
- CVE-2026-26933Improper Validation of Array Index in Packetbeat Leading to Denial of ServiceGo · github.com/elastic/beats, github.com/elastic/beats/v7 · fixed in 7.0.0-alpha2.0.20260126223743-dec1b31111ec
- CVE-2026-26931Memory Allocation with Excessive Size Value in Metricbeat Leading to Denial of ServiceGo · github.com/elastic/beats, github.com/elastic/beats/v7 · fixed in 7.0.0-alpha2.0.20260112100137-de072c4e371e
- CVE-2026-32805Romeo is vulnerable to Archive Slip due to missing checks in sanitizationGo · github.com/ctfer-io/romeo/webserver · fixed in 0.2.2
- CVE-2026-32737Romeo's invalid NetworkPolicy enables a malicious actor to pivot into another namespaceGo · github.com/ctfer-io/romeo/environment/deploy · fixed in 0.2.1
- CVE-2026-32694Insecure Direct Object Reference attack via predictable secret ID in JujuGo · github.com/juju/juju · fixed in 0.0.0-20260319091847-d06919eb03ec
- CVE-2026-32693Unauthorized access to Kubernetes secrets in JujuGo · github.com/juju/juju · fixed in 0.0.0-20260319091847-d06919eb03ec
- CVE-2026-32692Unauthorized update of out-of-scope Vault secretsGo · github.com/juju/juju · fixed in 0.0.0-20260319091847-d06919eb03ec
- CVE-2026-32691Timing ownership claim attack on new external back-end secretsGo · github.com/juju/juju · fixed in 3.6.19
- CVE-2026-32606IncusOS has a LUKS encryption bypass due to insufficient TPM policyGo · github.com/lxc/incus-os/incus-osd · fixed in 0.0.0-20260313012803-e3b35f230d23
- CVE-2026-32254Kube-router Proxy Module Blindly Trusts ExternalIPs/LoadBalancer IPs Enabling Cluster-Wide Traffic Hijacking and DNS DoSGo · github.com/cloudnativelabs/kube-router, github.com/cloudnativelabs/kube-router/v2 · fixed in 2.8.0
- CVE-2026-26304Permission Bypass in Playbook Run CreationGo · github.com/mattermost/mattermost-plugin-playbooks · fixed in 1.41.1-0.20260316224925-705f54a81841
- CVE-2026-24692Guest users can bypass read permissions via search APIGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.11+incompatible, 11.2.3+incompatible, 11.3.1+incompatible and more
- CVE-2026-22545Password Change Bypass via Auth Switch EndpointGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.11+incompatible, 11.2.3+incompatible, 11.3.1+incompatible and more
- CVE-2026-2455SSRF bypass via IPv4-mapped IPv6 literalsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 5.3.2-0.20260129133647-5d787969c2d5, 10.11.11, 11.2.3 and more
- CVE-2026-21386Private channel enumeration via /mute slash commandGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.11+incompatible, 11.2.3+incompatible, 11.3.1+incompatible and more
- CVE-2026-25780Memory Exhaustion via Malformed DOC File UploadGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.11+incompatible, 11.2.3+incompatible, 11.3.1+incompatible and more
- CVE-2026-4265Guest user can upload files without permission across teamsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.11+incompatible, 11.2.3+incompatible, 11.3.1+incompatible and more
- CVE-2026-25783Denial of service via malformed User-Agent header in getBrowserVersionGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.11+incompatible, 11.2.3+incompatible, 11.3.1+incompatible and more
- CVE-2026-24458DoS attack via login attempts with multi-megabyte passwordsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 5.3.2-0.20260129164748-7201f42d955f, 10.11.11, 11.2.3 and more
- CVE-2026-2578Information Disclosure via WebSocket Event When Deleting Unrevealed Burn on Read PostsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.11+incompatible, 11.2.3+incompatible, 11.3.1+incompatible and more
- CVE-2026-26246Memory Exhaustion via Malformed PSD File UploadGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 5.3.2-0.20260115183946-38b413a27604, 10.11.11, 11.2.3 and more
- CVE-2026-2458Unauthorized channel enumeration in private teams after member removalGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.11+incompatible, 11.2.3+incompatible, 11.3.1+incompatible and more
- CVE-2026-2457WebSocket Message Spoofing via Permalink Embed ManipulationGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.11+incompatible, 11.2.3+incompatible, 11.3.1+incompatible and more
- CVE-2026-2461Missing authorization check allows unauthorized modification of other users' comments on a boardGo · github.com/mattermost/mattermost-plugin-boards · fixed in 0.0.0-20260108044135-57c5be5b6ef5