Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-26190Milvus Allows Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System CompromiseGo · github.com/milvus-io/milvus · fixed in 2.5.27, 2.6.10
- CVE-2026-26187lakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory accessGo · github.com/treeverse/lakefs · fixed in 1.77.0
- CVE-2026-20796Time-of-check time-of-use vulnerability in common teams APIGo · github.com/mattermost/mattermost-server · fixed in 10.11.10+incompatible, 10.11.10
- CVE-2026-22892Insufficient Authorization in Mattermost Jira Plugin Allows Unauthorized Access to Post AttachmentsGo · github.com/mattermost/mattermost-server · fixed in 10.11.10+incompatible, 11.1.3+incompatible, 11.2.2+incompatible and more
- CVE-2026-26056Arbitrary WASM Code Execution via AnnotationOverrideFlight Injection in Yoke ATCGo · github.com/yokecd/yoke
- CVE-2026-26055Unauthenticated Admission Webhook Endpoints in Yoke ATCGo · github.com/yokecd/yoke
- CVE-2026-25996Inspektor Gadget uses unsanitized ANSI Escape Sequences In `columns` Output ModeGo · github.com/inspektor-gadget/inspektor-gadget · fixed in 0.49.1
- CVE-2026-25949Traefik: TCP readTimeout bypass via STARTTLS on PostgresGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 3.6.8
- CVE-2026-24895FrankenPHP affected by Path Confusion via Unicode casing in CGI path splitting allows execution of arbitrary filesGo · github.com/dunglas/frankenphp · fixed in 1.11.2
- CVE-2026-24894FrankenPHP leaks session data between requests in worker modeGo · github.com/dunglas/frankenphp · fixed in 1.11.2
- CVE-2026-21438webtransport-go affected by a Memory Exhaustion Attack due to Missing Cleanup of Streams MapGo · github.com/quic-go/webtransport-go · fixed in 0.10.0
- CVE-2026-21435webtransport-go CloseWithError can block indefinitelyGo · github.com/quic-go/webtransport-go · fixed in 0.10.0
- CVE-2026-21434webtransport-go affected by Memory Exhaustion Attack due to Missing Length Check in WT_CLOSE_SESSION CapsuleGo · github.com/marten-seemann/webtransport-go, github.com/quic-go/webtransport-go · fixed in 0.10.0
- CVE-2025-41117XSS in Grafana Explore stack traceGo · github.com/grafana/grafana · fixed in 12.2.5, 12.3.3
- CVE-2026-26014Pion DTLS uses random nonce generation with AES GCM ciphers risks leaking the authentication keyGo · github.com/pion/dtls, github.com/pion/dtls/v2 +1 · fixed in 3.0.11, 3.1.1
- CVE-2026-25935Vikunja Affected by XSS Via Task PreviewGo · code.vikunja.io/api
- CVE-2026-2303Heap Out-of-Bounds Read in Go Driver GSSAPI C Wrappers enables application crash or information leakGo · go.mongodb.org/mongo-driver, go.mongodb.org/mongo-driver/v2 · fixed in 1.17.7, 2.4.2
- CVE-2026-25992SiYuan has a File Read Interface Case Bypass VulnerabilityGo · github.com/siyuan-note/siyuan/kernel
- CVE-2026-25934go-git improperly verifies data integrity values for .idx and .pack filesGo · github.com/go-git/go-git, github.com/go-git/go-git/v4 +1 · fixed in 5.16.5
- CVE-2026-25890File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URLGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.57.1
- CVE-2026-25889File Browser has an Authentication Bypass in User Password UpdateGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.57.1
- CVE-2026-25791Sliver has a DNS C2 OTP Bypass Allows Unauthenticated Session Flooding and Denial of ServiceGo · github.com/bishopfox/sliver · fixed in 1.6.12
- CVE-2025-66630Fiber insecurely fallsback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failureGo · github.com/gofiber/fiber, github.com/gofiber/fiber/v2 · fixed in 2.52.11
- CVE-2026-25804Antrea has invalid enforcement order for network policy rules caused by integer overflowGo · antrea.io/antrea · fixed in 2.3.2, 2.4.3
- CVE-2026-25793Nebula Has Possible Blocklist Bypass via ECDSA Signature MalleabilityGo · github.com/slackhq/nebula · fixed in 1.10.3
- CVE-2026-25760Website Path Traversal / Arbitrary File Read (Authenticated) in SliverGo · github.com/bishopfox/sliver · fixed in 1.6.11
- CVE-2026-23989REVA Public Link ExploitGo · github.com/opencloud-eu/reva, github.com/opencloud-eu/reva/v2 · fixed in 2.40.3, 2.42.3
- CVE-2026-24851OpenFGA Improper Policy EnforcementGo · github.com/openfga/openfga · fixed in 1.11.3
- CVE-2026-24135Gogs vulnerable to arbitrary file deletion via path traversal in wiki page updateGo · gogs.io/gogs · fixed in 0.13.4
- CVE-2026-23633Gogs has arbitrary file read/write via path traversal in Git hook editingGo · gogs.io/gogs · fixed in 0.13.4