Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-29781Sliver: Authenticated Nil-Pointer Dereference in HandlersGo · github.com/bishopfox/sliver
- CVE-2026-29771Netmaker: Denial of Service via Server Shutdown EndpointGo · github.com/gravitl/netmaker · fixed in 1.2.0
- CVE-2026-29067ZITADEL: Account Takeover Due to Improper Instance Validation in V2 LoginGo · github.com/zitadel/zitadel, github.com/zitadel/zitadel/v2 · fixed in 1.80.0-v2.20.0.20251208091519-4c879b47334e, 4.7.1
- CVE-2026-29193ZITADEL: Bypassing Zitadel Login Behavior and Security Policy in Login V2Go · github.com/zitadel/zitadel, github.com/zitadel/zitadel/v2 · fixed in 4.12.1
- CVE-2026-29192ZITADEL: Stored XSS via Default URI Redirect Leads to Account TakeoverGo · github.com/zitadel/zitadel, github.com/zitadel/zitadel/v2 · fixed in 4.12.0
- CVE-2026-29191ZITADEL: 1-Click Account Takeover via XSS in /saml-post EndpointGo · github.com/zitadel/zitadel, github.com/zitadel/zitadel/v2 · fixed in 4.12.0
- CVE-2026-30247WeKnora: SSRF via RedirectionGo · github.com/tencent/weknora · fixed in 0.2.12
- CVE-2026-27142URLs in meta content attribute actions are not escaped in html/templateGo · stdlib · fixed in 1.25.8, 1.26.1
- CVE-2026-27139FileInfo can escape from a Root in osGo · stdlib · fixed in 1.25.8, 1.26.1
- CVE-2026-25679Incorrect parsing of IPv6 host literals in net/urlGo · stdlib · fixed in 1.25.8, 1.26.1
- CVE-2026-27138Panic in name constraint checking for malformed certificates in crypto/x509Go · stdlib · fixed in 1.26.1
- CVE-2026-27137Incorrect enforcement of email constraints in crypto/x509Go · stdlib · fixed in 1.26.1
- CVE-2026-30233OliveTin: View permission not being checked when returning dashboardsGo · github.com/olivetin/olivetin · fixed in 0.0.0-20260305082002-d7962710e7c4
- CVE-2026-30225OliveTin: RestartAction always runs actions as guestGo · github.com/olivetin/olivetin · fixed in 0.0.0-20260305000458-cb46a597b246
- CVE-2026-30223OliveTin: JWT Audience Validation Bypass in Local Key and HMAC ModesGo · github.com/olivetin/olivetin · fixed in 0.0.0-20260304231339-e97d8ecbd8d6
- CVE-2026-30224OliveTin: Session Fixation - Logout Fails to Invalidate Server-Side SessionGo · github.com/olivetin/olivetin · fixed in 0.0.0-20260304233115-d6a0abc3755d15
- CVE-2026-29791Agentgateway: Missing parameter sanitization in MCP to OpenAPI conversionGo · github.com/agentgateway/agentgateway · fixed in 0.12.0
- CVE-2026-29064Zarf: Symlink targets in archives are not validated against destination directoryGo · github.com/zarf-dev/zarf, github.com/zarf-dev/zarf/src/pkg/archive · fixed in 0.73.1
- CVE-2026-26017CoreDNS ACL BypassGo · github.com/coredns/coredns · fixed in 1.14.2
- CVE-2026-26018CoreDNS Loop Detection Denial of Service VulnerabilityGo · github.com/coredns/coredns · fixed in 1.14.2
- CVE-2026-29183SiYuan: Unauthenticated reflected SVG XSS in `/api/icon/getDynamicIcon` (`type=8`) enables arbitrary JavaScript executionGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260304034809-d68bd5a79391
- CVE-2026-29073SiYuan: Direct SQL Query API accessible to Reader-level users enables unauthorized database accessGo · github.com/siyuan-note/siyuan/kernel
- CVE-2026-29049melange: unbounded HTTP download in `melange update-cache` can exhaust disk in CIGo · chainguard.dev/melange · fixed in 0.43.4
- CVE-2026-29042Nuclio Shell Runtime Command Injection Leading to Privilege EscalationGo · github.com/nuclio/nuclio · fixed in 1.15.20
- CVE-2026-29084Gokapi: CSRF in Login EndpointGo · github.com/forceu/gokapi · fixed in 2.2.3
- CVE-2026-29061Gokapi: Privilege escalation via incomplete API-key permission revocation on user rank demotionGo · github.com/forceu/gokapi · fixed in 2.2.3
- CVE-2026-29060Gokapi: Privilege escalation with auth tokenGo · github.com/forceu/gokapi · fixed in 2.2.3
- CVE-2026-28683Gokapi: Stored XSS in SVG HotlinksGo · github.com/forceu/gokapi · fixed in 2.2.3
- CVE-2026-28682Gokapi: Data Leak in Upload Status StreamGo · github.com/forceu/gokapi · fixed in 2.2.3
- CVE-2026-28492File Browser: Path Traversal in Public Share Links Exposes Files Outside Shared DirectoryGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.61.0