Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-1580ingress-nginx auth-method nginx configuration injectionGo · k8s.io/ingress-nginx · fixed in 1.13.7, 1.14.3
- CVE-2025-70849Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /storGo · github.com/stefanprodan/podinfo · fixed in 1.8.1-0.20260314125853-83deb7fcb742
- CVE-2026-25060OpenList Insecure TLS Default ConfigurationGo · github.com/openlistteam/openlist, github.com/openlistteam/openlist/v3 +1 · fixed in 4.1.10
- CVE-2026-25059OpenList affected by Path Traversal in file copy and remove handlersGo · github.com/openlistteam/openlist, github.com/openlistteam/openlist/v3 +1 · fixed in 4.1.10
- CVE-2026-24051OpenTelemetry-Go Affected by Arbitrary Code Execution via PATH HijackingGo · go.opentelemetry.io/otel/sdk · fixed in 1.40.0
- CVE-2026-24905Inspektor Gadget has a Command Injection vulnerability in Makefile.buildGo · github.com/inspektor-gadget/inspektor-gadget · fixed in 0.51.1
- CVE-2026-24846malcontent's archive extraction could write outside extraction directoryGo · github.com/chainguard-dev/malcontent · fixed in 1.20.3
- CVE-2026-24845malcontent's OCI image scanning could expose registry credentialsGo · github.com/chainguard-dev/bincapz, github.com/chainguard-dev/malcontent · fixed in 1.20.3
- CVE-2025-61728Excessive CPU consumption when building archive index in archive/zipGo · stdlib · fixed in 1.24.12, 1.25.6
- CVE-2025-61726Memory exhaustion in query parameter parsing in net/urlGo · stdlib · fixed in 1.24.12, 1.25.6
- CVE-2025-61730Handshake messages may be processed at the incorrect encryption level in crypto/tlsGo · stdlib · fixed in 1.24.12, 1.25.6
- CVE-2025-61731Arbitrary file write using cgo pkg-config directive in cmd/goGo · toolchain · fixed in 1.24.12, 1.25.6
- CVE-2025-68119Unexpected code execution when invoking toolchain in cmd/goGo · toolchain · fixed in 1.25.6
- CVE-2026-1237Vulnerable cross-model authorization in juju.Go · github.com/juju/juju
- CVE-2026-24748Kargo's `GetConfig()` and `RefreshResource()` API endpoints allow unauthenticated accessGo · github.com/akuity/kargo · fixed in 1.6.3, 1.7.7, 1.8.7
- CVE-2026-24738gmrtd ReadFile Vulnerable to Denial of Service via Excessive TLV Length ValuesGo · github.com/gmrtd/gmrtd · fixed in 0.17.2
- CVE-2026-24740Dozzle Agent Label-Based Access Control Bypass Allows Unauthorized Container Shell AccessGo · github.com/amir20/dozzle · fixed in 1.29.1-0.20260125230338-620e59aa2463
- CVE-2026-23881Kyverno Denial of Service via Context Variable Amplification in Policy EngineGo · github.com/kyverno/kyverno · fixed in 1.15.3, 1.16.3
- CVE-2026-22039Kyverno Cross-Namespace Privilege Escalation via Policy apiCallGo · github.com/kyverno/kyverno · fixed in 1.15.3, 1.16.3
- CVE-2026-24686go-tuf Path Traversal in TAP 4 Multirepo Client Allows Arbitrary File Write via Malicious Repository NamesGo · github.com/theupdateframework/go-tuf/v2 · fixed in 2.4.1
- CVE-2026-24470Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalNameGo · github.com/zalando/skipper · fixed in 0.24.0
- CVE-2025-14525Kubevirt: kubevirt: vm administration denial of service via guest agentGo · kubevirt.io/kubevirt
- CVE-2025-11065Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructureGo · github.com/go-viper/mapstructure, github.com/go-viper/mapstructure/v2 · fixed in 2.4.0
- CVE-2026-24137sigstore legacy TUF client allows for arbitrary file writes with target cache path traversalGo · github.com/sigstore/sigstore · fixed in 1.10.4
- CVE-2025-66719An issue was discovered in Free5gc NRF 1.4.0.Go · github.com/free5gc/nrf · fixed in 1.4.1
- CVE-2026-24124Dragonfly Manager Job API Allows Unauthenticated AccessGo · d7y.io/dragonfly/v2 · fixed in 2.4.1
- CVE-2026-24117Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URLGo · github.com/sigstore/rekor · fixed in 1.5.0
- CVE-2026-20912Gitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment DisclosureGo · code.gitea.io/gitea, github.com/go-gitea/gitea · fixed in 1.25.4
- CVE-2026-20904Gitea: Broken access control in OpenID visibility toggle enables cross-user visibility changesGo · code.gitea.io/gitea, github.com/go-gitea/gitea · fixed in 1.25.4
- CVE-2026-20897Gitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR)Go · code.gitea.io/gitea, github.com/go-gitea/gitea · fixed in 1.25.4