Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-1078110xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUserGo · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260728091109-0ecbd106c37b
- CVE-2026-107810Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are appliedGo · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260728074146-a467ed652591
- CVE-2026-107809Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIsGo · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260728074433-a3999bd78a3b
- CVE-2026-107808Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)Go · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260728074558-95cd21b70814
- CVE-2026-107807Nginx UI: Node Secret Credential Exposure via URL Query ParameterGo · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260728074433-a3999bd78a3b
- CVE-2026-107806Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config OverwriteGo · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260728074146-a467ed652591
- CVE-2026-107805Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storageGo · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260901043436-8c9b9a1aff21
- CVE-2026-107804Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockoutGo · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260904075558-e30e331303fc
- CVE-2026-97032HTTP/2 server crash due to HPACK encoder race in net/httpGo · golang.org/x/net, stdlib · fixed in 0.60.0, 1.26.9, 1.27.2
- CVE-2026-94439HTTP/1 server connection desynchronization after 2xx CONNECT response in net/httpGo · stdlib · fixed in 1.26.9, 1.27.2
- CVE-2026-78663Double flow control refund on HTTP/2 server streams in net/httpGo · golang.org/x/net, stdlib · fixed in 0.60.0, 1.26.9, 1.27.2
- CVE-2026-78669Excessive CPU consumption from repeated initial window changes in net/httpGo · golang.org/x/net, stdlib · fixed in 0.60.0, 1.26.9, 1.27.2
- CVE-2026-78660HTTP/2 transport accepts malformed framing-related headers in net/httpGo · golang.org/x/net, stdlib · fixed in 0.60.0, 1.26.9, 1.27.2
- CVE-2026-78667Lack of limit on size of parsed Range headers in net/httpGo · stdlib · fixed in 1.26.9, 1.27.2
- CVE-2026-94440Memory limit bypass when parsing MIME headers in net/textproto, mime/multipartGo · stdlib · fixed in 1.26.9, 1.27.2
- CVE-2026-97031Reject malformed ECH outer extension references in crypto/tlsGo · stdlib · fixed in 1.26.9, 1.27.2
- CVE-2026-56866HTTP/1 client connection desynchronization after CONNECT rejection in net/httpGo · stdlib · fixed in 1.26.9, 1.27.2
- CVE-2026-56857Root.Mkdir(All) can follow junctions out of the root on Windows in osGo · stdlib · fixed in 1.26.9, 1.27.2
- CVE-2026-78659HTTP/2 server memory exhaustion due to Trailer headers in net/httpGo · golang.org/x/net, stdlib · fixed in 0.60.0, 1.26.9, 1.27.2
- CVE-2026-94447Checksum database bypass for golang.org/toolchain in cmd/goGo · toolchain · fixed in 1.26.9, 1.27.2
- CVE-2026-94444Checksum bypass for golang.org/fips140 in cmd/goGo · toolchain · fixed in 1.26.9, 1.27.2
- CVE-2026-97030Recognize yield as regexp preceder keyword in html/templateGo · stdlib · fixed in 1.26.9, 1.27.2
- CVE-2026-94448Reset context tracking on consecutive template expressions in html/templateGo · stdlib · fixed in 1.26.9, 1.27.2
- CVE-2026-107386amqp091-go: Pre-negotiation frame limit is not enforced to 4KBGo · github.com/rabbitmq/amqp091-go · fixed in 1.14.0
- CVE-2026-61801github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database filesGo · github.com/moby/sys/user · fixed in 0.4.1
- CVE-2026-107225Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xmlGo · github.com/xuri/excelize/v2 · fixed in 2.11.1-0.20260731010303-ae2113b410e5
- CVE-2026-107224Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReaderGo · github.com/xuri/excelize/v2 · fixed in 2.11.1-0.20260805032953-db93f8d89de7
- CVE-2026-107223Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the processGo · github.com/xuri/excelize/v2 · fixed in 2.11.1-0.20260807015645-a54c578af309
- CVE-2026-107222Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil checkGo · github.com/xuri/excelize/v2 · fixed in 2.11.1-0.20260812075026-be7a16390fa6
- CVE-2026-107221Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read APIGo · github.com/xuri/excelize/v2 · fixed in 2.11.1-0.20260816084418-46a5eb289448