Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-100836Edgeless Systems Contrast through 1.20.0 Denial of Service via ciphertextContainerGo · github.com/edgelesssys/contrast · fixed in 1.21.0
- CVE-2026-100839Contrast before 1.18.0 AML Injection Remote Code ExecutionGo · github.com/edgelesssys/contrast · fixed in 1.18.0
- CVE-2026-100838Contrast before 1.19.1 CopyFile Policy Symlink SubversionGo · github.com/edgelesssys/contrast · fixed in 1.19.1
- CVE-2025-71426Contrast before 1.4.1 Coordinator Impersonation via Unauthenticated RecoveryGo · github.com/edgelesssys/contrast · fixed in 1.4.1
- CVE-2025-71425Contrast before 1.8.1 Information Disclosure via LoggingGo · github.com/edgelesssys/contrast · fixed in 1.8.1
- CVE-2025-71424Edgeless Systems Contrast before 1.9.1 Insecure Volume MountGo · github.com/edgelesssys/contrast · fixed in 1.9.1
- CVE-2025-71423Edgelesssys Contrast before 1.12.2 Workload Secrets Information DisclosureGo · github.com/edgelesssys/contrast · fixed in 1.12.2
- CVE-2025-71422Contrast before 1.12.1 Insecure LUKS2 Persistent StorageGo · github.com/edgelesssys/contrast · fixed in 1.12.1
- CVE-2026-53493Containerd has image-pull DoS via crafted OCI index graph amplificationGo · github.com/containerd/containerd, github.com/containerd/containerd/v2 · fixed in 1.7.36, 2.0.13, 2.2.9 and more
- CVE-2026-62286Dozzle label filters do not restrict container event and statistics streamsGo · github.com/amir20/dozzle · fixed in 1.29.1-0.20260622172006-19c01e0fb491
- CVE-2026-61604ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypassGo · github.com/ixofoundation/ixo-blockchain, github.com/ixofoundation/ixo-blockchain/v3 +5 · fixed in 8.0.0
- CVE-2026-85056ZITADEL: MFA bypass via session reuse in Login V2Go · github.com/zitadel/zitadel · fixed in 1.80.0-v2.20.0.20260717062356-56f4798ed31f
- CVE-2026-85057ZITADEL: Actions V1 sandbox escape: host file read via require()Go · github.com/zitadel/zitadel · fixed in 1.80.0-v2.20.0.20260717062331-baf6ed501b68
- CVE-2026-82405Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated callerGo · github.com/klever-io/klever-go · fixed in 1.7.20
- CVE-2026-82409Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgeryGo · github.com/klever-io/klever-go · fixed in 1.7.20
- CVE-2026-82407Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoSGo · github.com/klever-io/klever-go · fixed in 1.7.20
- CVE-2026-86065Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)Go · github.com/klever-io/klever-go · fixed in 1.7.20
- CVE-2026-86064Klever-Go: /log controls global node loggingGo · github.com/klever-io/klever-go · fixed in 1.7.20
- CVE-2026-82406Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplaceGo · github.com/klever-io/klever-go · fixed in 1.7.20
- CVE-2026-63132OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing AttackGo · github.com/openbao/openbao · fixed in 0.0.0-20260713141742-763625a20721
- CVE-2026-63131OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix)Go · github.com/openbao/openbao · fixed in 0.0.0-20260713133043-f58d848c139e
- CVE-2026-77285OpenBao Agent Writes Secrets to StdoutGo · github.com/openbao/openbao · fixed in 0.0.0-20260714163218-90272575e5f5
- CVE-2026-92700Caddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files via case variationGo · github.com/caddyserver/caddy/v2 · fixed in 2.11.4
- CVE-2026-92284Caddy: Unbounded body buffer via {http.request.body} placeholder — memory exhaustion DoSGo · github.com/caddyserver/caddy/v2 · fixed in 2.11.4
- CVE-2026-79767Gardener: Authorization Bypass via Group Subject InjectionGo · gardener/gardener, github.com/gardener/gardener · fixed in 1.143.3, 1.144.2, 1.142.6
- CVE-2026-77322SIPGO: DoS via unvalidated WebSocket frame lengthGo · github.com/emiago/sipgo · fixed in 1.4.3
- CVE-2026-58268SIPGO: DoS via unvalidated Content-Length in the stream parserGo · github.com/emiago/sipgo · fixed in 1.4.1
- CVE-2026-76805Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz ModeGo · github.com/projectdiscovery/nuclei, github.com/projectdiscovery/nuclei/v2 +1 · fixed in 3.10.0
- CVE-2026-76802Nuclei: Arbitrary Command Execution via DAST Code Signature BypassGo · github.com/projectdiscovery/nuclei, github.com/projectdiscovery/nuclei/v2 +1 · fixed in 3.10.0
- CVE-2026-76804Nuclei: Local File Read via Workflow File-Protocol Gate BypassGo · github.com/projectdiscovery/nuclei, github.com/projectdiscovery/nuclei/v2 +1 · fixed in 3.10.0