Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-2463Unauthorized access to invite ID during team creationGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.11+incompatible, 11.2.3+incompatible, 11.3.1+incompatible and more
- CVE-2026-2476MS Teams plugin sensitive config values not properly masked in support packetsGo · github.com/mattermost/mattermost-plugin-msteams · fixed in 1.15.1-0.20260102165339-036c761bd3cb
- CVE-2026-2456Denial of Service via Unbounded Memory Allocation in Integration ActionsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.11+incompatible, 11.2.3+incompatible, 11.3.1+incompatible and more
- CVE-2026-30405An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXT_HOP path attributeGo · github.com/osrg/gobgp, github.com/osrg/gobgp/v3 +1 · fixed in 4.4.0
- CVE-2026-32720Improper Access Control in github.com/ctfer-io/monitoringGo · github.com/ctfer-io/monitoring · fixed in 0.2.1
- CVE-2026-32704SiYuan renderSprig: missing admin check allows any user to read full workspace DBGo · github.com/siyuan-note/siyuan/kernel · fixed in 3.6.1
- CVE-2026-32614Go ShangMi SM9 Infinity-Point Ciphertext Forgery VulnerabilityGo · github.com/emmansun/gmsm · fixed in 0.41.1
- CVE-2026-31886Dagu has a Path Traversal via `dagRunId` in Inline DAG ExecutionGo · github.com/dagu-org/dagu
- CVE-2026-30961Gokapi's File Request MaxSize Limit Bypassed via Multi-Chunk UploadGo · github.com/forceu/gokapi · fixed in 2.2.4
- CVE-2026-30955Gokapi vulnerable to DoS in E2E Metadata ParserGo · github.com/forceu/gokapi · fixed in 2.2.4
- CVE-2026-30943Gokapi has Privilege Escalation in File ReplaceGo · github.com/forceu/gokapi · fixed in 2.2.4
- CVE-2026-30915SFTPGo improperly sanitizes placeholders in group home directories/key prefixesGo · github.com/drakkan/sftpgo, github.com/drakkan/sftpgo/v2 · fixed in 2.7.1
- CVE-2026-30914SFTPGo has a Path Traversal and Permission Bypass via Path Normalization DiscrepancyGo · github.com/drakkan/sftpgo, github.com/drakkan/sftpgo/v2 · fixed in 2.7.1
- CVE-2026-32320Ella Core: AMF DoS via malformed PathSwitchRequest with empty NR security capability bitstringsGo · github.com/ellanetworks/core · fixed in 1.5.1
- CVE-2026-32319Ella Core: Unauthenticated AMF DoS via malformed InitialUEMessage with undersized integrity-protected NAS payloadGo · github.com/ellanetworks/core · fixed in 1.5.1
- CVE-2026-32301Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URLGo · github.com/centrifugal/centrifugo, github.com/centrifugal/centrifugo/v3 +3 · fixed in 6.7.0
- CVE-2026-32246Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpointGo · github.com/steveiliop56/tinyauth · fixed in 1.0.1-20260311144920-9eb2d33064b7
- CVE-2026-32245Tinyauth's OIDC authorization codes are not bound to client on token exchangeGo · github.com/steveiliop56/tinyauth · fixed in 1.0.1-20260311144920-9eb2d33064b7
- CVE-2026-2808Consul vulnerable to arbitrary file reads through the vault kubernetes authentication providerGo · github.com/hashicorp/consul · fixed in 1.18.21, 1.22.5, 1.21.11
- CVE-2026-32136AdGuard Home: HTTP/2 Cleartext (h2c) Upgrade Authentication BypassGo · github.com/adguardteam/adguardhome · fixed in 0.107.73
- CVE-2026-32110SiYuan has a Full-Read SSRF via /api/network/forwardProxyGo · github.com/siyuan-note/siyuan/kernel · fixed in 3.6.0
- CVE-2026-32102OliveTin Unauthorized Action Output Disclosure via EventStreamGo · github.com/olivetin/olivetin · fixed in 3000.10.2
- CVE-2026-31961Unbounded memory allocation in Quill via unvalidated size fields in Mach-O binary parsingGo · github.com/anchore/quill · fixed in 0.7.1
- CVE-2026-31960DoS in Quill via unbounded read of HTTP response body during notarizationGo · github.com/anchore/quill · fixed in 0.7.1
- CVE-2026-31959SSRF in Quill via unvalidated URL from Apple notarization log retrievalGo · github.com/anchore/quill · fixed in 0.7.1
- CVE-2026-31866Allocation of Resources Without Limits or Throttling in flagdGo · github.com/open-feature/flagd/flagd · fixed in 0.14.2
- CVE-2026-31863Improper Restriction of Excessive Authentication Attempts in github.com/anyproto/anytype-heartGo · github.com/anyproto/anytype-cli, github.com/anyproto/anytype-heart · fixed in 0.1.11, 0.48.4
- CVE-2026-29777Traefik has a kubernetes gateway rule injection via unescaped backticks in HTTPRoute match valuesGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 3.6.10
- CVE-2026-31892WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference ModeGo · github.com/argoproj/argo-workflows, github.com/argoproj/argo-workflows/v2 +2 · fixed in 3.7.11, 4.0.2
- CVE-2026-28229Argo Workflows has unauthorized access to Argo Workflows TemplateGo · github.com/argoproj/argo-workflows, github.com/argoproj/argo-workflows/v2 +2 · fixed in 3.7.11, 4.0.2