Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-31817OliveTin's unsafe parsing of UniqueTrackingId can be used to write filesGo · github.com/olivetin/olivetin · fixed in 0.0.0-20260309102040-b03af0e2eca3
- CVE-2026-31809SiYuan has a SVG Sanitizer Bypass via Whitespace in `javascript:` URI — Unauthenticated XSSGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260310025236-297bd526708f
- CVE-2026-31807SiYuan has a SVG Sanitizer Bypass via `<animate>` Element — Unauthenticated XSSGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260310025236-297bd526708f
- CVE-2026-31801zot create-only policy allows overwrite attempts of existing latest tag (update permission not required)Go · zotregistry.dev/zot, zotregistry.dev/zot/v2 · fixed in 2.1.15
- CVE-2026-26330Envoy global rate limit may crash when the response phase limit is enabled and the response phase request is failed directlyGo · github.com/envoyproxy/envoy
- CVE-2026-26311Envoy HTTP: filter chain execution on reset streams causing UAF crashGo · github.com/envoyproxy/envoy
- CVE-2026-26310Crash for scoped ip address in Envoy during DNSGo · github.com/envoyproxy/envoy
- CVE-2026-26309Envoy has an off-by-one write in JsonEscaper::escapeString()Go · github.com/envoyproxy/envoy
- CVE-2026-26308Envoy has an RBAC Header Validation Bypass via Multi-Value Header ConcatenationGo · github.com/envoyproxy/envoy · fixed in 1.37.1, 1.36.5, 1.35.9 and more
- CVE-2026-30934FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)Go · github.com/gtsteffaniak/filebrowser · fixed in 0.0.0-20260307130210-09713b32a5f6
- CVE-2026-30933FileBrowser Quantum Incomplete Remediation of CVE-2026-27611: Password-Protected Share Bypass via /public/api/share/infoGo · github.com/gtsteffaniak/filebrowser/backend · fixed in 0.0.0-20260307130210-09713b32a5f6
- CVE-2026-30869SiYuan has a Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret LeakageGo · github.com/siyuan-note/siyuan/kernel · fixed in 3.5.10
- CVE-2026-29773kubewarden-controller cross-namespace data exfiltration via deprecated host callback bindingGo · github.com/kubewarden/kubewarden-controller · fixed in 1.33.0
- CVE-2026-28513Pocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchangeGo · github.com/pocket-id/pocket-id/backend · fixed in 0.0.0-20260307173642-b59e35cb59ae
- CVE-2026-28512Pocket ID: OAuth redirect_uri validation bypass via userinfo/host confusionGo · github.com/pocket-id/pocket-id/backend · fixed in 0.0.0-20260228130835-3a339e33191c
- CVE-2026-30926SiYuan Note publish service authorization bypass allows low-privilege users to modify notebook contentGo · github.com/siyuan-note/siyuan/kernel
- CVE-2026-30861WeKnora: Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration ValidationGo · github.com/tencent/weknora · fixed in 0.2.10
- CVE-2026-30860WeKnora: Remote Code Execution via SQL Injection Bypass in AI Database Query ToolGo · github.com/tencent/weknora · fixed in 0.2.12
- CVE-2026-30859WeKnora: Broken Access Control - Cross-Tenant Data ExposureGo · github.com/tencent/weknora · fixed in 0.2.12
- CVE-2026-30858WeKnora: DNS Rebinding Vulnerability in web_fetch Tool Allows SSRF to Internal ResourcesGo · github.com/tencent/weknora · fixed in 0.3.0
- CVE-2026-30857WeKnora: Unauthorized Cross‑Tenant Knowledge Base CloningGo · github.com/tencent/weknora · fixed in 0.3.0
- CVE-2026-30856WeKnora: Tool Execution Hijacking via Ambigous Naming Convention In MCP client and Indirect Prompt InjectionGo · github.com/tencent/weknora · fixed in 0.3.0
- CVE-2026-30855WeKnora: Broken Access Control in Tenant ManagementGo · github.com/tencent/weknora · fixed in 0.3.1, 0.3.2
- CVE-2026-30851Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege EscalationGo · github.com/caddyserver/caddy/v2, github.com/caddyserver/caddy/v2/modules/caddyhttp/reverseproxy · fixed in 2.11.2
- CVE-2026-30852Caddy: vars_regexp double-expands user input, leaking env vars and filesGo · github.com/caddyserver/caddy/v2, github.com/caddyserver/caddy/v2/modules/caddyhttp · fixed in 2.11.2
- CVE-2026-29196Netmaker: Service User with Network Access Can Access config files with WireGuard Private KeysGo · github.com/gravitl/netmaker · fixed in 1.5.0
- CVE-2026-29195Netmaker: Privilege Escalation from Admin to Super-Admin via User UpdateGo · github.com/gravitl/netmaker · fixed in 1.5.0
- CVE-2026-29194Netmaker: Insufficient Authorization in Host Token VerificationGo · github.com/gravitl/netmaker · fixed in 1.5.0
- CVE-2026-30832Soft Serve: SSRF via unvalidated LFS endpoint in repo importGo · github.com/charmbracelet/soft-serve · fixed in 0.11.4
- CVE-2026-30834PinchTab: SSRF with Full Response Exfiltration via Download HandlerGo · github.com/pinchtab/pinchtab, github.com/pinchtab/pinchtab/cmd/pinchtab · fixed in 0.7.7