Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-20888Gitea Pull Requests Auto-Merge: Read-Only Users Can Cancel Scheduled Auto-Merge via Web Endpoint (Authorization Bypass)Go · code.gitea.io/gitea, github.com/go-gitea/gitea · fixed in 1.25.4
- CVE-2026-20883Gitea Stopwatch API Missing Authorization Check Leads to Post-Revocation Information DisclosureGo · code.gitea.io/gitea, github.com/go-gitea/gitea · fixed in 1.25.4
- CVE-2026-20800Notification API Leaks Private Repository Issue Titles After Collaborator Permission RevocationGo · code.gitea.io/gitea, github.com/go-gitea/gitea · fixed in 1.25.4
- CVE-2026-20750Gitea Organization Projects Cross-Organization Authorization Bypass via Project ID (IDOR)Go · code.gitea.io/gitea, github.com/go-gitea/gitea · fixed in 1.25.4
- CVE-2026-20736Gitea Web Attachment Deletion: Cross-Repository Unauthorized Deletion via Missing Repo Ownership CheckGo · code.gitea.io/gitea · fixed in 1.25.4
- CVE-2026-0798Gitea Release Email Notifications Leak Private Repository Release Details After Access RevocationGo · code.gitea.io/gitea · fixed in 1.25.4
- CVE-2026-24058Soft Serve has Critical Authentication BypassGo · github.com/charmbracelet/soft-serve · fixed in 0.11.3
- CVE-2026-23954Incus container image templating arbitrary host file read and writeGo · github.com/lxc/incus, github.com/lxc/incus/v6 +1
- CVE-2026-23953Incus container environment configuration newline injectionGo · github.com/lxc/incus, github.com/lxc/incus/v6 · fixed in 6.21.0
- CVE-2026-23831Rekor COSE v0.0.1 Canonicalize crashes when passed empty MessageGo · github.com/sigstore/rekor · fixed in 1.5.0
- CVE-2026-23992go-tuf improperly validates the configured threshold for delegationsGo · github.com/theupdateframework/go-tuf/v2 · fixed in 2.3.1
- CVE-2026-23991go-tuf affected by client DoS via malformed server responseGo · github.com/theupdateframework/go-tuf/v2 · fixed in 2.3.1
- CVE-2025-69820Directory Traversal vulnerability in Beam beta9 v.0.1.521 allows a remote attacker to obtain sensitive information via the joinCleanPath funGo · github.com/beam-cloud/beta9
- CVE-2026-23990Flux Operator Web UI Impersonation Bypass via Empty OIDC ClaimsGo · github.com/controlplaneio-fluxcd/flux-operator · fixed in 0.40.0
- CVE-2026-23960Argo Workflows affected by stored XSS in the artifact directory listingGo · github.com/argoproj/argo-workflows, github.com/argoproj/argo-workflows/v2 +1 · fixed in 3.6.17, 3.7.8
- CVE-2026-23518Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollmentGo · github.com/fleetdm/fleet, github.com/fleetdm/fleet/v4 · fixed in 4.78.3, 4.77.1, 4.76.2 and more
- CVE-2026-23517Fleet has an Access Control vulnerability in debug/pprof endpointsGo · github.com/fleetdm/fleet, github.com/fleetdm/fleet/v4 · fixed in 4.78.3, 4.77.1, 4.76.2 and more
- CVE-2026-22822External Secrets Operator insecurely retrieves secrets through the getSecretKey templating functionGo · github.com/external-secrets/external-secrets · fixed in 1.2.0
- CVE-2026-22808Fleet Windows MDM endpoint has a Cross-site Scripting vulnerabilityGo · github.com/fleetdm/fleet, github.com/fleetdm/fleet/v4 · fixed in 4.78.2, 4.77.1, 4.76.2 and more
- CVE-2026-23849File Browser vulnerable to Username Enumeration via Timing Attack in /api/loginGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.55.0
- CVE-2026-23851SiYuan Vulnerable to Arbitrary File Read via File Copy FunctionalityGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260118092521-f8f4b517077b
- CVE-2026-23850SiYuan vulnerable to arbitrary file readGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260118092326-b2274baba2e1
- CVE-2026-23847SiYuan Vulnerable to Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIconGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260118021606-5c0cc375b475
- CVE-2026-21696Endless reprocessing/reupload of activity log data due to SQLite max parameters limit not being consideredGo · github.com/pterodactyl/wings · fixed in 1.12.0
- CVE-2025-69199Pterodactyl Wings's websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks under certain circumstancesGo · github.com/pterodactyl/wings · fixed in 1.12.0
- CVE-2026-23845Mailpit Vulnerable to Server-Side Request Forgery (SSRF) via HTML Check APIGo · github.com/axllent/mailpit · fixed in 1.28.3
- CVE-2026-23829Mailpit has SMTP Header Injection via Regex BypassGo · github.com/axllent/mailpit · fixed in 1.28.3
- CVE-2026-23644esm.sh has path traversal in `extractPackageTarball` that enables file writes from malicious packagesGo · github.com/esm-dev/esm.sh · fixed in 0.0.0-20260116051925-c62ab83c589e
- CVE-2026-23742Skipper arbitrary code execution through lua filtersGo · github.com/zalando/skipper · fixed in 0.23.0
- CVE-2026-23645SiYuan Vulnerable to Stored Cross-Site Scripting (XSS) via Unrestricted SVG File UploadGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260116101155-11115da3d0de