Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-45243Summarize < 0.15.1 Browser Extension Missing Authorization via Content Scriptnpm · @steipete/summarize · fixed in 0.15.0
- CVE-2026-45829A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated…PyPI · chromadb
- CVE-2026-7304CVE-2026-7304PyPI · sglang
- CVE-2026-7302CVE-2026-7302PyPI · sglang
- CVE-2026-7301CVE-2026-7301PyPI · sglang
- CVE-2026-6333SSRF via Host Header Spoofing in Custom Slash CommandsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 5.3.2-0.20260325160634-e738016c5920, 10.11.14+incompatible, 11.5.2+incompatible and more
- CVE-2026-6345Prevent password disclosure and force reset during Slack importGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.14+incompatible, 11.4.4+incompatible, 11.5.2+incompatible and more
- CVE-2026-6346Sensitive credentials exposed in plaintext in Mattermost support packetsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.14+incompatible, 11.4.4+incompatible, 11.5.2+incompatible and more
- CVE-2026-28732Slash command trigger-word update allowed command hijackingGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 5.3.2-0.20260306123948-f5fe8ded6b63, 10.11.14+incompatible, 11.4.4+incompatible and more
- CVE-2026-6343Mattermost Playbooks Plugin fails to enforce view permissions in list endpoints, allowing unauthorized access to public playbooksGo · github.com/mattermost/mattermost-plugin-playbooks, github.com/mattermost/mattermost-server +3 · fixed in 1.41.1-0.20260309184833-887d9cacb616, 10.11.14+incompatible, 11.4.4+incompatible and more
- CVE-2026-6347Mattermost Calls plugin exposes TURN server credentials in plaintext in support packetsGo · github.com/mattermost/mattermost-plugin-calls, github.com/mattermost/mattermost-server · fixed in 1.12.0-rc2, 11.5.2, 10.11.14 and more
- CVE-2026-5163Missing authorization check in AI message rewrite endpoint allows access to private thread contentGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 11.5.2+incompatible, 5.3.2-0.20260401090745-f4d1abe7e8f5, 8.0.0-20260401090745-f4d1abe7e8f5 and more
- CVE-2026-4286Playbooks Plugin fails to validate team transfers, allowing unauthorized removal of member access via playbook updateGo · github.com/mattermost/mattermost-plugin-playbooks, github.com/mattermost/mattermost-server +3 · fixed in 1.41.1-0.20260213020129-e1d6ec2c94e6, 10.11.14+incompatible, 11.5.2+incompatible and more
- CVE-2026-6339Missing request origin validation on burn-on-read reveal endpointGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 5.3.2-0.20260327001745-7a339a6438f5, 11.4.4+incompatible, 11.5.2+incompatible and more
- CVE-2026-6340Memory Exhaustion via Malicious 7zip File UploadGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 5.3.2-0.20260325191733-fb11968f8798, 10.11.14+incompatible, 11.4.4+incompatible and more
- CVE-2026-3495Unescaped variables during error page compositionGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.14+incompatible, 11.5.2+incompatible, 5.3.2-0.20260310115442-5a1ea95044dc and more
- CVE-2026-4273Insufficient token rotation validation in remote cluster invite confirmationGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.14+incompatible, 11.5.2+incompatible, 5.3.2-0.20260313190740-742e0be95074 and more
- CVE-2026-3637Mattermost fails to enforce create_post permission when editing postsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 5.3.2-0.20260316171743-090408f09f53, 10.11.14+incompatible, 11.4.4+incompatible and more
- CVE-2026-2325Improper Input Validation in MS Teams Meetings API HandlerGo · github.com/mattermost/mattermost-plugin-msteams-meetings, github.com/mattermost/mattermost-server · fixed in 1.1.1-0.20260213105619-c5892dd169de, 11.5.2, 10.11.14 and more
- CVE-2026-28759Insufficient authorization in shared channel membership sync allows remote cluster to remove users from arbitrary channelsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 5.3.2-0.20260216150504-8738f8c4b3d4, 10.11.14+incompatible, 11.4.4+incompatible and more
- CVE-2026-6334OAuth authorization code client binding not enforced during token redemption in MattermostGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 5.3.2-0.20260318173148-e9ae890a013b, 10.11.14+incompatible, 11.5.2+incompatible and more
- CVE-2026-8783omec-project amf dispatcher.go UERadioCapabilityCheckResponse null pointer dereferenceGo · github.com/omec-project/amf · fixed in 2.2.0
- CVE-2026-8782omec-project amf NGAP Message handler.go null pointer dereferenceGo · github.com/omec-project/amf · fixed in 2.2.0
- CVE-2026-8781omec-project amf handler.go RANConfiguration null pointer dereferenceGo · github.com/omec-project/amf · fixed in 2.2.0
- CVE-2026-8780omec-project amf NGAP Message dispatcher.go memory corruptionGo · github.com/omec-project/amf · fixed in 2.2.0
- CVE-2026-8779omec-project amf handler.go NGSetupRequest memory corruptionGo · github.com/omec-project/amf · fixed in 2.2.0
- CVE-2025-57282ngrok v4.3.3 and 5.0.0-beta.2 is vulnerable to Command Injection.npm · ngrok
- CVE-2026-8771linlinjava litemall Front-end WeChat API WxGoodsController.java list sql injectionMaven · org.linlinjava:litemall-wx-api
- CVE-2026-8769vercel ai provider-utils response-handler.ts createJsonErrorResponseHandler resource consumptionnpm · @ai-sdk/provider-utils · fixed in 3.0.28, 4.0.33, 5.0.1
- CVE-2026-8766Kilo-Org kilocode Environment Variable config.ts load information disclosurenpm · @kilocode/cli