Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-29188File Browser: TUS Delete Endpoint Bypasses Delete Permission CheckGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.61.1
- CVE-2026-28790OliveTin: Unauthenticated Action Termination via KillAction When Guests Must LoginGo · github.com/olivetin/olivetin · fixed in 0.0.0-20260302002902-d9804182eae4
- CVE-2026-28789OliveTin: Unauthenticated DoS via concurrent map writes in OAuth2 state handlingGo · github.com/olivetin/olivetin · fixed in 0.0.0-20260301235225-f044d90d5525c
- CVE-2026-28342OliveTin: Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API EndpointGo · github.com/olivetin/olivetin · fixed in 0.0.0-20260227002407-2eb5f0ba79d4
- CVE-2026-26276Gogs: DOM-based XSS via milestone selectionGo · gogs.io/gogs
- CVE-2026-26196Gogs: Access tokens get exposed through URL params in API requestsGo · gogs.io/gogs
- CVE-2026-26195Gogs: Stored XSS in branch and wiki views through author and committer namesGo · gogs.io/gogs
- CVE-2026-26194Gogs: Release tag option injection in release deletionGo · gogs.io/gogs · fixed in 0.14.2
- CVE-2026-25921Gogs: Cross-repository LFS object overwrite via missing content hash verificationGo · gogs.io/gogs · fixed in 0.14.2
- CVE-2026-26022Gogs: Stored XSS via data URI in issue commentsGo · gogs.io/gogs · fixed in 0.14.2
- CVE-2026-27944Nginx UI: Unauthenticated Backup Download with Encryption Key DisclosureGo · github.com/0xjacky/nginx-ui · fixed in 2.3.3
- CVE-2026-29054Traefik: lowercase `Connection` tokens can delete traefik-managed forwarded identity headers (for example, `X-Real-Ip`)Go · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.38, 3.6.9
- CVE-2026-26999Traefik: tcp router clears read deadlines before tls forwarding, enabling stalled handshakes (slowloris doS)Go · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.38, 3.6.9
- CVE-2026-26998Traefik: unbounded io.ReadAll on auth server response body causes OOM denial of service(DOS)Go · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.38, 3.6.9
- CVE-2025-15558Docker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation VulnerabilityGo · github.com/docker/cli, github.com/docker/compose +2 · fixed in 29.2.0, 29.2.0+incompatible, 5.1.0
- CVE-2025-62879Rancher Backup Operator pod's logs leak S3 tokensGo · github.com/rancher/backup-restore-operator · fixed in 9.0.1, 8.1.2, 7.0.5 and more
- CVE-2026-3351Authorization Bypass in LXD GET /1.0/certificates EndpointGo · github.com/canonical/lxd · fixed in 0.0.0-20260224152359-d936c90d47cf
- CVE-2026-28407malcontent's nested archive extraction failure can drop content from scan inputsGo · github.com/chainguard-dev/malcontent · fixed in 1.21.0
- CVE-2026-28406kaniko has tar archive path traversal in build context extraction allows writing files outside destination directoryGo · github.com/chainguard-dev/kaniko · fixed in 1.25.10
- CVE-2026-28268Vikunja Vulnerable to Account Takeover via Password Reset Token ReuseGo · code.vikunja.io/api
- CVE-2026-27734Beszel Vulnerable to Docker API Path Traversal via Unsanitized Container IDGo · github.com/henrygd/beszel · fixed in 0.18.4
- CVE-2026-28280`osctrl-admin` has Stored Cross-Site Scripting (XSS) in On-Demand Query ListGo · github.com/jmpsec/osctrl · fixed in 0.5.0
- CVE-2026-28279`osctrl-admin` Vulnerable to OS Command Injection via Environment ConfigurationGo · github.com/jmpsec/osctrl · fixed in 0.5.0
- CVE-2026-27141Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/netGo · golang.org/x/net · fixed in 0.51.0
- CVE-2026-27465Fleet: Sensitive Google Calendar credentials disclosed to low-privileged usersGo · github.com/fleetdm/fleet/v4 · fixed in 4.80.1
- CVE-2026-25963Fleet: Authorization Bypass in certificate template batch deletion for team administratorsGo · github.com/fleetdm/fleet/v4 · fixed in 4.80.1
- CVE-2026-23999Fleet: Device lock PIN can be predicted if lock time is knownGo · github.com/fleetdm/fleet/v4 · fixed in 4.80.1
- CVE-2026-24004Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpointGo · github.com/fleetdm/fleet/v4 · fixed in 4.80.1
- CVE-2026-27969Vitess users with backup storage access can write to arbitrary file paths on restoreGo · vitess.io/vitess · fixed in 0.23.3, 0.22.4
- CVE-2026-27965Vitess users with backup storage access can gain unauthorized access to production deployment environmentsGo · vitess.io/vitess · fixed in 0.22.4, 0.23.3