Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-14435Application-Level DoS via infinite re-render loop in user profile handlingGo · github.com/mattermost/mattermost-server · fixed in 10.11.9, 11.1.2, 11.0.7 and more
- CVE-2025-14822DoS from quadratic complexity in model.ParseHashtagsGo · github.com/mattermost/mattermost-server · fixed in 10.11.9, 11.2.0, 10.11.9+incompatible and more
- CVE-2026-22045Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stallGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.35, 3.6.7
- CVE-2025-68671lakeFS is Missing Timestamp Validation in S3 Gateway AuthenticationGo · github.com/treeverse/lakefs · fixed in 1.75.0
- CVE-2026-23520Arcane has a Command Injection in Arcane Updater Lifecycle Labels Enables RCEGo · github.com/getarcaneapp/arcane/backend · fixed in 0.0.0-20260114065515-5a9c2f92e11f
- CVE-2026-23511ZITADEL has a user enumeration vulnerability in Login UIsGo · github.com/zitadel/zitadel · fixed in 4.9.1, 3.4.6
- CVE-2025-66292DPanel has an arbitrary file deletion vulnerability in /api/common/attach/delete interfaceGo · github.com/donknap/dpanel · fixed in 1.9.2
- CVE-2026-0528Improper Input Validation in Metricbeat Leading to Denial of ServiceGo · github.com/elastic/beats, github.com/elastic/beats/v7 · fixed in 7.0.0-alpha2.0.20251217054608-6e42552a23ce, 8.19.10, 9.1.10 and more
- CVE-2026-22868go-ethereum has a DoS via malicious p2p messageGo · github.com/ethereum/go-ethereum · fixed in 1.16.8
- CVE-2026-22862go-ethereum has a DoS via malicious p2p messageGo · github.com/ethereum/go-ethereum · fixed in 1.16.8
- CVE-2026-22786Gin-vue-admin has arbitrary file upload vulnerability caused by path traversalGo · github.com/flipped-aurora/gin-vue-admin
- CVE-2026-22772Fulcio vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex BypassGo · github.com/sigstore/fulcio · fixed in 1.8.5
- CVE-2026-22771Envoy Extension Policy lua scripts injection causes arbitrary command executionGo · github.com/envoyproxy/gateway · fixed in 1.6.2, 1.5.7
- CVE-2026-22703Cosign verification accepts any valid Rekor entry under certain conditionsGo · github.com/sigstore/cosign, github.com/sigstore/cosign/v2 +1 · fixed in 2.6.2, 3.0.4
- CVE-2026-22689Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emailsGo · github.com/axllent/mailpit · fixed in 1.28.2, 0.0.0-20260110031614
- CVE-2026-22688WeKnora has Command Injection in MCP stdio testGo · github.com/tencent/weknora · fixed in 0.2.5
- CVE-2026-22687WeKnora vulnerable to SQL InjectionGo · github.com/tencent/weknora · fixed in 0.2.5
- CVE-2025-60538A lack of rate limiting in the login page of shiori v1.7.4 and below allows attackers to bypass authentication via a brute force attack.Go · github.com/go-shiori/shiori
- CVE-2026-22253Soft Serve is missing an authorization check in LFS lock deletionGo · github.com/charmbracelet/soft-serve · fixed in 0.11.2
- CVE-2025-68151CoreDNS gRPC/HTTPS/HTTP3 servers lack resource limits, enabling DoS via unbounded connections and oversized messagesGo · github.com/coredns/coredns · fixed in 1.14.0
- CVE-2026-21885Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resourcesGo · miniflux.app, miniflux.app/v2 · fixed in 2.2.16
- CVE-2025-62877Harvest may expose OS default ssh login password via SUSE Virtualization Interactive InstallerGo · github.com/harvester/harvester-installer
- CVE-2025-66001NeuVector OpenID Connect is vulnerable to man-in-the-middle (MITM)Go · github.com/neuvector/neuvector · fixed in 5.4.8
- CVE-2026-21859Mailpit Proxy Endpoint is Vulnerable to Server-Side Request Forgery (SSRF)Go · github.com/axllent/mailpit · fixed in 1.28.1
- CVE-2026-0650OpenFlagr <= 1.1.18 Authentication Bypass via Prefix Whitelist Path NormalizationGo · github.com/openflagr/flagr · fixed in 0.0.0-20251009103504-fe83dc87aa40
- CVE-2025-68954Pterodactyl does not revoke SFTP access when server is deleted or permissions reducedGo · github.com/pterodactyl/wings · fixed in 1.12.0
- CVE-2026-21483listmonk Vulnerable to Stored XSS Leading to Admin Account TakeoverGo · github.com/knadh/listmonk · fixed in 6.0.0, 1.1.1-0.20251231125615-74dc5a01cfbb
- CVE-2025-45286A cross-site scripting (XSS) vulnerability in mccutchen httpbin v2.17.1 allows attackers to execute arbitrary web scripts or HTML via a crafGo · github.com/mccutchen/go-httpbin, github.com/mccutchen/go-httpbin/v2 · fixed in 2.18.0
- CVE-2025-69413In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.Go · code.gitea.io/gitea · fixed in 1.25.2
- CVE-2025-14986ExecuteMultiOperation Namespace Policy BypassGo · go.temporal.io/server · fixed in 1.27.4, 1.28.2, 1.29.2