Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-27585Caddy's improper sanitization of glob characters in file matcher may lead to bypassing security protectionsGo · github.com/caddyserver/caddy/v2 · fixed in 2.11.1
- CVE-2026-27571nats-server websockets are vulnerable to pre-auth memory DoSGo · github.com/nats-io/nats-server, github.com/nats-io/nats-server/v2 · fixed in 2.11.12, 2.12.3
- CVE-2026-1229Incorrect calculation in CIRCL secp384r1 CombinedMultGo · github.com/cloudflare/circl · fixed in 1.6.3
- CVE-2026-25802New API has Potential XSS in its MarkdownRenderer componentGo · github.com/quantumnous/new-api · fixed in 0.10.8-alpha.9
- CVE-2026-25591New API has an SQL LIKE Wildcard Injection DoS via Token SearchGo · github.com/quantumnous/new-api · fixed in 0.10.8-alpha.10
- CVE-2026-27112Kargo has an Authorization Bypass Vulnerability in Batch Resource Creation API EndpointsGo · github.com/akuity/kargo · fixed in 1.7.8, 1.8.11, 1.9.3
- CVE-2026-27111Kargo has Missing Authorization Vulnerabilities in Approval & Promotion REST API EndpointsGo · github.com/akuity/kargo · fixed in 1.9.3
- CVE-2026-26994uTLS ServerHellos are accepted without checking TLS 1.3 downgrade canariesGo · github.com/refraction-networking/utls · fixed in 1.7.0
- CVE-2026-27017uTLS has a Chrome Parrot Fingerprint Vulnerability due to GREASE ECH Cipher Suite MismatchGo · github.com/refraction-networking/utls · fixed in 1.8.1
- CVE-2026-26963Cilium may not enforce host firewall policies when Native Routing, WireGuard and Node Encryption are enabledGo · github.com/cilium/cilium · fixed in 1.18.6
- CVE-2026-26958filippo.io/edwards25519 MultiScalarMult function produces invalid results or undefined behavior if receiver is not the identityGo · filippo.io/edwards25519 · fixed in 1.1.1
- CVE-2026-24122Cosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be OverlookedGo · github.com/sigstore/cosign, github.com/sigstore/cosign/v2 +1 · fixed in 3.0.5
- CVE-2026-26315Go Ethereum Improperly Validates the ECIES Public Key in RLPx HandshakeGo · github.com/ethereum/go-ethereum · fixed in 1.16.9
- CVE-2026-26314Go Ethereum affected by DoS via malicious p2p messageGo · github.com/ethereum/go-ethereum · fixed in 1.16.9
- CVE-2026-26313Go Ethereum affected by DoS via malicious p2p messageGo · github.com/ethereum/go-ethereum · fixed in 1.17.0
- CVE-2026-26205opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in `input.parsed_path`Go · github.com/open-policy-agent/opa-envoy-plugin · fixed in 1.13.2-envoy-2
- CVE-2026-26201emp3r0r Affected by Concurrent Map Access DoS (panic/crash)Go · github.com/jm33-m0/emp3r0r/core · fixed in 0.0.0-20260212232424-ea4d074f081d
- CVE-2026-24834Kata Container to Guest micro VM privilege escalationGo · github.com/kata-containers/kata-containers/src/runtime · fixed in 0.0.0-20260219090056-6a672503973b
- CVE-2026-25766Echo has a Windows path traversal via backslash in middleware.Static default filesystemGo · github.com/labstack/echo/v5 · fixed in 5.0.3
- CVE-2026-25229Gogs Authorization Bypass Allows Cross-Repository Label ModificationGo · gogs.io/gogs · fixed in 0.14.0
- CVE-2026-25242Gogs allows unauthenticated file uploadsGo · gogs.io/gogs · fixed in 0.14.1
- CVE-2026-25232Gogs has a Protected Branch Deletion Bypass in Web InterfaceGo · gogs.io/gogs · fixed in 0.14.1
- CVE-2026-25120Gogs Allows Cross-Repository Comment Deletion via DeleteCommentGo · gogs.io/gogs · fixed in 0.14.0
- CVE-2025-69725An Open Redirect vulnerability in the go-chi/chi >=5.2.2 RedirectSlashes function allows remote attackers to redirect victim users to…Go · github.com/go-chi/chi, github.com/go-chi/chi/v2 +3 · fixed in 5.2.4
- CVE-2025-14573Team Admin Bypass of Invite Permissions via allow_open_invite FieldGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 5.3.2-0.20251215190648-6404ab29acc0, 8.0.0-20251215190648-6404ab29acc0
- CVE-2025-14350Information disclosure via channel mentions in postsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 5.3.2-0.20251209134645-761e56bb11cc, 8.0.0-20251209134645-761e56bb11cc
- CVE-2025-13821User profile update exposes password hash and MFA secretsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 5.3.2-0.20251210191531-cd17b61de41b, 8.0.0-20251210191531-cd17b61de41b
- CVE-2026-0997Mattermost Zoom Plugin channel preference API lacks authorization checksGo · github.com/mattermost/mattermost-plugin-zoom · fixed in 1.11.0
- CVE-2026-0998Mattermost Zoom Plugin allows unauthorized meeting creation and post modification via insufficient API access controlsGo · github.com/mattermost/mattermost-plugin-zoom · fixed in 1.12.0
- CVE-2026-0999Authentication bypass via userID login when email and username login are disabledGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 5.3.2-0.20251212052346-61651b0df7ea, 8.0.0-20251212052346-61651b0df7ea