Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-107220Excelize: Panic in cellInRange on a worksheet with an empty mergeCell refGo · github.com/xuri/excelize/v2 · fixed in 2.11.1-0.20260820023833-99903a3240e5
- CVE-2026-107219Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFileGo · github.com/xuri/excelize/v2 · fixed in 2.11.1-0.20260906004932-2badfcd5841d
- CVE-2026-107218Excelize: RIGHT() on supplementary-plane text slices with a negative index and panicsGo · github.com/xuri/excelize/v2 · fixed in 2.11.1-0.20260908032718-ecd99d761fe0
- CVE-2026-107217Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rowsGo · github.com/xuri/excelize, github.com/xuri/excelize/v2 · fixed in 2.11.1-0.20260910071107-696050fbf14e
- CVE-2026-107216Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflowGo · github.com/xuri/excelize/v2 · fixed in 2.11.1-0.20260911060113-ea12859e43c6
- CVE-2026-107215Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoSGo · github.com/360entsecgroup-skylar/excelize/v2, github.com/xuri/excelize/v2 · fixed in 2.11.1-0.20260912113515-5f636f9dcde5
- CVE-2026-56851Panic parsing crafted input in x/text/secure/precis in golang.org/x/textGo · golang.org/x/text · fixed in 0.41.0
- CVE-2026-107214Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooksGo · github.com/360entsecgroup-skylar/excelize/v2, github.com/xuri/excelize/v2 · fixed in 2.11.1-0.20260915055537-22f76f9acb94
- CVE-2026-107213Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing elementGo · github.com/xuri/excelize/v2 · fixed in 2.11.1-0.20260929015830-8ffeb07ec9a3
- CVE-2026-107212Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for daysGo · github.com/360entsecgroup-skylar/excelize/v2, github.com/xuri/excelize/v2 · fixed in 2.11.1-0.20260930021559-01a9ff32fb3c
- CVE-2026-107211Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panicGo · github.com/xuri/excelize/v2 · fixed in 2.11.1-0.20261003002531-6258dcebc4e2
- CVE-2026-62252Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First LoginGo · github.com/sipcapture/homer-app · fixed in 0.0.0-20260625091610-b2e942031ff8
- CVE-2026-62253Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)Go · github.com/sipcapture/homer-app · fixed in 0.0.0-20260625093330-5e90809657c9
- CVE-2026-62251Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/queryGo · github.com/sipcapture/homer-app · fixed in 0.0.0-20260625085520-a7d027dc684b
- CVE-2026-26287External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltrationGo · github.com/external-secrets/external-secrets · fixed in 1.3.2
- CVE-2026-105163crossplane crossplane-runtime ImageConfig client.go Get toctouGo · github.com/crossplane/crossplane-runtime/v2 · fixed in 2.4.0-rc.1, 2.3.3
- CVE-2026-55252OpenRun: Redirect URL validation bypass using //host paths leads to Open RedirectGo · github.com/openrundev/openrun · fixed in 0.17.7
- GHSA-9CQF-HHRQ-7V45SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class…Go · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260812083335-251596fc0de2
- CVE-2026-63209Integer Overflow or Wraparound and Out-of-bounds Write in compressGo · github.com/klauspost/compress · fixed in 1.18.7
- CVE-2026-101090Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uriGo · github.com/nezhahq/nezha
- CVE-2026-101084obot before v0.21.1 Authorization Bypass via /mcp-connectGo · github.com/obot-platform/obot · fixed in 0.21.1
- CVE-2026-101064Obot before v0.23.0 Server-Side Request Forgery via MCPGo · github.com/obot-platform/obot · fixed in 0.23.0
- CVE-2026-101063Obot before v0.23.0 Authentication Bypass via Registry APIGo · github.com/obot-platform/obot · fixed in 0.23.0
- CVE-2026-101062Obot before v0.23.0 Authentication Bypass via OAuth Dynamic Client RegistrationGo · github.com/obot-platform/obot · fixed in 0.23.0
- CVE-2026-101056Cloudreve before 4.16.1 Authentication Bypass via Cached Context HintGo · github.com/cloudreve/cloudreve, github.com/cloudreve/cloudreve/v3 +1
- CVE-2026-101051Cloudreve before 4.16.1 Path Traversal via Remote DownloadGo · github.com/cloudreve/cloudreve, github.com/cloudreve/cloudreve/v3 +1
- CVE-2026-101048Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scopeGo · github.com/cloudreve/cloudreve, github.com/cloudreve/cloudreve/v3 +1 · fixed in 4.0.0-20260626022735-332a9d800205
- CVE-2026-101047Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLsGo · github.com/fleetdm/fleet/v4 · fixed in 4.87.0
- CVE-2026-101046Fleet before 4.89.0 SQL Injection via ORDER BY Activity EndpointsGo · github.com/fleetdm/fleet/v4 · fixed in 4.89.0
- CVE-2026-100837Edgeless Systems Contrast through 1.20.0 Credential Leak via Registry Suffix MatchingGo · github.com/edgelesssys/contrast · fixed in 1.21.0