Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-27900Terraform Provider Debug Logs Vulnerable to Sensitive Information ExposureGo · github.com/linode/terraform-provider-linode, github.com/linode/terraform-provider-linode/v2 +1 · fixed in 3.9.0
- CVE-2026-22728sealed-secrets /v1/rotate can widen sealing scope to cluster-wide via attacker-controlled template annotationsGo · github.com/bitnami-labs/sealed-secrets · fixed in 0.36.0
- CVE-2026-27899WireGuard Portal Vulnerable to Privilege Escalation to Admin via User Self-UpdateGo · github.com/h44z/wg-portal · fixed in 2.1.3
- CVE-2026-27896MCP Go SDK Vulnerable to Improper Handling of Case SensitivityGo · github.com/modelcontextprotocol/go-sdk · fixed in 1.3.1
- CVE-2026-27946ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser APIGo · github.com/zitadel/zitadel · fixed in 4.11.1, 3.4.7, 1.80.0-v2.20.0.20260225053417-0261536243e5
- CVE-2026-27945ZITADEL has potential SSRF via ActionsGo · github.com/zitadel/zitadel, github.com/zitadel/zitadel/v2 · fixed in 1.80.0-v2.20.0.20260225053328-b2532e966621, 4.11.1
- CVE-2026-27840ZITADEL's truncated opaque tokens are still validGo · github.com/zitadel/zitadel · fixed in 4.11.0, 3.4.7, 1.80.0-v2.20.0.20260216092519-feab8e1fa371
- CVE-2026-26186Fleet has a SQL injection via backtick escape in ORDER BY parameterGo · github.com/fleetdm/fleet/v4 · fixed in 4.80.1
- CVE-2026-27808Mailpit is Vulnerable to Server-Side Request Forgery (SSRF) via Link Check APIGo · github.com/axllent/mailpit · fixed in 1.29.2
- CVE-2026-27819Vikunja has Path Traversal in CLI RestoreGo · code.vikunja.io/api
- CVE-2026-27616Vikunja Vulnerable to Stored Cross-Site Scripting (XSS) via Unsanitized SVG Attachment Upload Leading to Token ExposureGo · code.vikunja.io/api
- CVE-2026-27575Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password ChangeGo · code.vikunja.io/api
- CVE-2026-27116Vikunja has Reflected HTML Injection via filter Parameter in Projects ModuleGo · code.vikunja.io/api
- CVE-2026-24005OpenKruise PodProbeMarker is Vulnerable to SSRF via Unrestricted Host FieldGo · github.com/openkruise/kruise · fixed in 1.7.5, 1.8.3
- CVE-2026-27730esm.sh has SSRF localhost/private-network bypass in `/http(s)` module routeGo · github.com/esm-dev/esm.sh · fixed in 0.0.0-20250616164159-0593516c4cfa
- CVE-2025-50180esm.sh is vulnerable to full-response SSRFGo · github.com/esm-dev/esm.sh · fixed in 0.0.0-20250616164159-0593516c4cfa
- CVE-2025-62878Local Path Provisioner vulnerable to Path Traversal via parameters.pathPatternGo · github.com/rancher/local-path-provisioner · fixed in 0.0.34
- CVE-2025-67601Rancher CLI skips TLS verification on Rancher CLI login commandGo · github.com/rancher/rancher · fixed in 0.0.0-20260129092249-bb0625fd1896, 2.13.2, 2.12.6 and more
- CVE-2025-67860NeuVector scanner insecurely handles passwords as command argumentsGo · github.com/neuvector/scanner · fixed in 4.072
- CVE-2026-27626OliveTin vulnerable to OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checksGo · github.com/olivetin/olivetin · fixed in 0.0.0-20260222101908-4bbd2eab1532
- CVE-2026-27611FileBrowser Quantum: Password Protection Not Enforced on Shared File LinksGo · github.com/gtsteffaniak/filebrowser/backend · fixed in 0.0.0-20260221163904-dbcfba993b85
- CVE-2026-27598Dagu: Path traversal in DAG creation allows arbitrary YAML file write outside DAGs directoryGo · github.com/dagu-org/dagu
- CVE-2026-25899Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded AllocationGo · github.com/gofiber/fiber/v3 · fixed in 3.1.0
- CVE-2026-25891Fiber has an Arbitrary File Read in Static Middleware on WindowsGo · github.com/gofiber/fiber/v3 · fixed in 3.1.0
- CVE-2026-25882Fiber has a Denial of Service Vulnerability via Route Parameter OverflowGo · github.com/gofiber/fiber/v2, github.com/gofiber/fiber/v3 · fixed in 2.52.12, 3.1.0
- CVE-2026-27590Caddy: Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transportGo · github.com/caddyserver/caddy/v2 · fixed in 2.11.1
- CVE-2026-27589Caddy vulnerable to cross-origin config application via local admin API /load (caddy)Go · github.com/caddyserver/caddy/v2 · fixed in 2.11.1
- CVE-2026-27588Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypassGo · github.com/caddyserver/caddy/v2 · fixed in 2.11.1
- CVE-2026-27587Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypassGo · github.com/caddyserver/caddy/v2 · fixed in 2.11.1
- CVE-2026-27586Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformedGo · github.com/caddyserver/caddy/v2 · fixed in 2.11.1