Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-23632Gogs user can update repository content with read-only permissionGo · gogs.io/gogs · fixed in 0.13.4
- CVE-2026-22592Gogs is Vulnerable to Denial of ServiceGo · gogs.io/gogs · fixed in 0.13.4
- CVE-2025-64175Gogs Vulnerable to 2FA Bypass via Recovery CodeGo · gogs.io/gogs · fixed in 0.13.4
- CVE-2025-64111Gogs's update .git/config file allows remote command executionGo · gogs.io/gogs · fixed in 0.13.4
- CVE-2025-13523Cross-Site Scripting (XSS) via Unescaped Display Names in Mattermost Confluence Plugin OAuth2 FlowGo · github.com/mattermost/mattermost-plugin-confluence · fixed in 1.7.0
- CVE-2025-70963Gophish <=0.12.1 is vulnerable to Incorrect Access Control.Go · github.com/gophish/gophish
- CVE-2025-58190Infinite parsing loop in golang.org/x/netGo · golang.org/x/net · fixed in 0.45.0
- CVE-2025-47911Quadratic parsing complexity in golang.org/x/net/htmlGo · golang.org/x/net, golang.org/x/net/html · fixed in 0.45.0
- CVE-2025-68121Unexpected session resumption in crypto/tlsGo · stdlib · fixed in 1.24.13, 1.25.7, 1.26.0-rc.3
- CVE-2025-61732Potential code smuggling via doc comments in cmd/cgoGo · toolchain · fixed in 1.24.13, 1.25.7
- CVE-2025-22873Improper access to parent directory of root in osGo · stdlib · fixed in 1.23.9, 1.24.3
- CVE-2026-25578Navidrome is vulnerable to XSS via comment from song metadataGo · github.com/navidrome/navidrome · fixed in 0.60.0
- CVE-2026-25579Navidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpointsGo · github.com/navidrome/navidrome · fixed in 0.60.0
- CVE-2026-25539SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCEGo · github.com/siyuan-note/siyuan/kernel
- CVE-2026-25538Devtron Attributes API Unauthorized Access Leading to API Token Signing Key LeakageGo · github.com/devtron-labs/devtron
- CVE-2026-25518cert-manager-controller DoS via Specially Crafted DNS ResponseGo · github.com/cert-manager/cert-manager · fixed in 1.18.5, 1.19.3
- CVE-2026-25499terraform-provider-proxmox has insecure sudo recommendation in the documentationGo · github.com/bpg/terraform-provider-proxmox · fixed in 0.93.1
- CVE-2026-25161Alist vulnerable to Path Traversal in multiple file operation handlersGo · github.com/alist-org/alist, github.com/alist-org/alist/v3 · fixed in 3.57.0
- CVE-2026-25160Alist has Insecure TLS ConfigGo · github.com/alist-org/alist, github.com/alist-org/alist/v3 · fixed in 3.57.0
- CVE-2026-25145melange has a path traversal in license-path which allows reading files outside workspaceGo · chainguard.dev/melange · fixed in 0.40.3
- CVE-2026-25143melange affected by potential host command execution via license-check YAML mode patch pipelineGo · chainguard.dev/melange · fixed in 0.40.3
- CVE-2026-24844melange pipeline working-directory could allow command injectionGo · chainguard.dev/melange · fixed in 0.40.3
- CVE-2026-24843melange QEMU runner could write files outside workspace directoryGo · chainguard.dev/melange · fixed in 0.40.3
- CVE-2026-25140apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streamsGo · chainguard.dev/apko · fixed in 1.1.1
- CVE-2026-25121apko is vulnerable to path traversal in apko dirFS which allows filesystem writes outside baseGo · chainguard.dev/apko · fixed in 1.1.0
- CVE-2026-25122apko is vulnerable to unbounded resource consumption in expandapk.Split on attacker-controlled .apk streamsGo · chainguard.dev/apko · fixed in 1.1.0
- CVE-2026-24735Apache Answer: Revision API Improper Access Control leads to Information DisclosureGo · github.com/apache/answer · fixed in 2.0.0
- CVE-2026-24514ingress-nginx Admission Controller denial of serviceGo · k8s.io/ingress-nginx · fixed in 1.13.7, 1.14.3
- CVE-2026-24513ingress-nginx auth-url protection bypassGo · k8s.io/ingress-nginx · fixed in 1.13.7, 1.14.3
- CVE-2026-24512ingress-nginx auth-method nginx configuration injectionGo · k8s.io/ingress-nginx · fixed in 1.13.7, 1.14.3