Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-55068free5GC: NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpointsGo · github.com/free5gc/free5gc · fixed in 4.2.2, 4.2.2+incompatible
- CVE-2026-55067Vikunja: Authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignmentGo · code.vikunja.io/api · fixed in 2.4.0
- CVE-2026-55066Vikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_idGo · code.vikunja.io/api · fixed in 2.4.0
- CVE-2026-55065Vikunja: Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/apiGo · code.vikunja.io/api · fixed in 2.4.0
- CVE-2026-55064Vikunja incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0Go · code.vikunja.io/api · fixed in 2.4.0
- CVE-2026-54766Vikunja: Project duplication bypasses write-permission check on the target parent projectGo · code.vikunja.io/api · fixed in 2.4.0
- CVE-2026-54788dd-trace-rs: Unbounded W3C tracestate parsing may lead to DoScrates.io · datadog-opentelemetry · fixed in 0.3.3
- CVE-2026-55834Pocket ID: Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=noneGo · github.com/pocket-id/pocket-id/backend · fixed in 2.9.0
- CVE-2026-55569aqua: Archive extraction in aqua follows attacker-planted symlinks, allowing writes outside the install directoryGo · github.com/aquaproj/aqua, github.com/aquaproj/aqua/v2 · fixed in 2.60.1
- CVE-2026-54755Klever-Go: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token)Go · github.com/klever-io/klever-go · fixed in 1.7.19
- CVE-2026-54754Klever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)Go · github.com/klever-io/klever-go · fixed in 1.7.19
- CVE-2026-55108KubeVela Terraform remote loader DoS via unbounded file readGo · github.com/oam-dev/kubevela · fixed in 1.9.14, 1.10.9, 1.11.0-alpha.4
- CVE-2026-54746Hatchet: Cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and UnsubscribeGo · github.com/hatchet-dev/hatchet · fixed in 0.91.2
- CVE-2026-56854Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/sshGo · golang.org/x/crypto · fixed in 0.55.0
- CVE-2026-15603morgan vulnerable to Log Forging via unescaped Unicode line separatorsnpm · morgan · fixed in 1.12.0
- CVE-2026-82261SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserializationnpm · @sveltejs/kit · fixed in 2.52.2
- CVE-2026-82260SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserializationnpm · @sveltejs/kit · fixed in 2.52.2
- CVE-2026-82259SvelteKit 2.49.0 before 2.53.3 Denial of Service via formnpm · @sveltejs/kit · fixed in 2.53.3
- CVE-2026-82258SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batchnpm · @sveltejs/kit · fixed in 2.60.1
- CVE-2026-82257SvelteKit before 2.69.1 Prototype Pollution via File Inputnpm · @sveltejs/kit · fixed in 2.69.1
- CVE-2026-82256SvelteKit before 2.69.1 Denial of Service via Remote Formnpm · @sveltejs/kit · fixed in 2.69.1
- CVE-2026-82255gitoxide 0.25.4 HTTP Credential Leak via Redirectcrates.io · gix-transport · fixed in 0.56.0
- CVE-2026-82254gitoxide before 0.69.0 Denial of Service via gix-packcrates.io · gix-pack · fixed in 0.69.0
- CVE-2026-82253gitoxide before 0.82.0 Path Traversal via Submodule Name Validation Bypasscrates.io · gix, gix-validate · fixed in 0.83.0, 0.11.1
- CVE-2026-82252gitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodulescrates.io · gitoxide, gix · fixed in 0.52.1, 0.83.0
- CVE-2026-82251gitoxide before 0.52.1 Path Traversal via Submodule Namecrates.io · gitoxide, gix · fixed in 0.52.1, 0.83.0
- CVE-2026-82250gitoxide gix-packetline before 0.21.5 Denial of Servicecrates.io · gix-packetline · fixed in 0.21.5
- CVE-2026-82234SiYuan before v3.8.1 SSRF via DNS-Rebinding TOCTOUGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260813142806-dd2778b70d02
- CVE-2026-82233SiYuan before v3.8.1 Path Traversal via asset.uploadGo · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260813142104-b26a4a307b8a
- CVE-2026-81525Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP DriverPackagist · mongodb/mongodb · fixed in 1.21.4, 2.4.1