Start for Free

Know every threat before it ships

200K+ vulnerabilities, malicious packages, and supply chain threats enriched with Corgea's research.

All npm PyPI Go NuGet crates.io Maven RubyGems

42,040 vulnerabilities

MEDIUM 6.3
PyPI

CVE-2026-55649

GeoNode has Stored XSS in Documents metadata abstract field
MEDIUM 5.5
PyPI

CVE-2026-46429

GeoNode has Unrestricted File Upload
HIGH 7.7
Go

GHSA-qx75-2p3r-pwm5

LXD has project restriction bypass in instance copy across projects

HIGH 7.7
Go

GHSA-7mr3-28h5-m5vx

LXD has project restriction bypass for custom volume copy across projects

CRITICAL 9.9
Go

GHSA-47w9-6r3f-938g

LXD has restricted project bypass leading to arbitrary command execution
MEDIUM 5.3
PyPI

GHSA-mxwc-wh95-pw4g

Trapster Community: Unauthenticated malformed DNS compression pointers crash per-packet honeypot handler
HIGH 8.8
PyPI

CVE-2026-33050

GeoNode has OS command injection via uploaded file layer name
CRITICAL 9.9
Go

GHSA-pjff-c2wc-f6jm

LXD has arbitrary file write on client due to trusted image hash
MEDIUM 6.5
Go

CVE-2026-9639

LXD has CreateCustomVolumeFromBackup nil-pointer dereference on volumes[0].snapshots[*].expires_at
CRITICAL 9.9
Go

GHSA-vghh-5rfx-xhq8

LXD has arbitrary file read+write on host via rootfs/ symlink in malicious image
CRITICAL 9.9
Go

GHSA-fmc8-p6q7-75cc

LXD has argument injection in backup compression algorithm leading to AFW and ACE
CRITICAL 9.9
Go

GHSA-jpf8-86f3-wp38

LXD has arbitrary file read+write on host via templates/ symlink in malicious image
CRITICAL 9.9
Go

GHSA-9j25-mm2h-2f76

LXD has arbitrary file write on host via `exec-output` symlink in crafted image
HIGH 7.5
PyPI

CVE-2026-43977

wger Vulnerable to IDOR: Authenticated Users Can Read Any User's Private Workout Session Data via Template Routine API
MEDIUM 5.0
Go

CVE-2026-28385

LXD: SSRF via image import from URL allows internal network probing by authenticated users
MEDIUM 5.5
Go

CVE-2026-62361

listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials
UNKNOWN
Go

CVE-2026-62284

OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy
LOW 3.7
NuGet

CVE-2026-56378

ImageMagick: Malicious PCD files trigger 1‑byte heap Out-of-bounds Read and DoS

LOW 3.7
NuGet

GHSA-jmqv-2mx7-544h

Duplicate Advisory: ImageMagick: Malicious PCD files trigger 1‑byte heap Out-of-bounds Read and DoS
MEDIUM 4.3
Maven

CVE-2026-16454

Eclipse hawkBit DDI has Privilege Escalation that allows Tenant-Isolated Firmware Exfiltration
MEDIUM 4.3
Maven

GHSA-f3j8-8ggq-f9x2

Duplicate Advisory: Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration
MEDIUM 5.4
PyPI

CVE-2026-6658

jupyter/nbconvert allows Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports
CRITICAL 9.9
Go

CVE-2026-48752

Incus has arbitrary file read+write on host via templates/ symlink in malicious image
HIGH 7.7
Go

CVE-2026-55621

Incus has a project restriction bypass for custom volume copy across projects
CRITICAL 9.9
Go

CVE-2026-48755

Incus has an argument injection in backup compression algorithm leading to AFW and ACE
CRITICAL 9.9
Go

CVE-2026-48769

Incus has an arbitrary file write on its client due to trusted image hash
CRITICAL 9.9
Go

CVE-2026-48750

Incus has an arbitrary file write on host via `exec-output` symlink in crafted image
CRITICAL 9.9
Go

CVE-2026-48751

Incus has a restricted project bypass leading to arbitrary command execution
CRITICAL 9.9
Go

CVE-2026-48749

Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image
HIGH 8.1
PyPI

CVE-2026-43978

wger: Privilege escalation via trainer-login session chaining allows gym trainer to impersonate gym manager
MEDIUM 5.4
Go

CVE-2026-13426

github.com/mattermost/mattermost/server/public vulnerable to path traversal in API route construction
UNKNOWN
Go

CVE-2026-12411

LXD allows cross-guest volume hijack via DevLXD device patch in github.com/canonical/lxd
HIGH 7.5
Go

GO-2026-6898

imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field
UNKNOWN
Go

GO-2026-6906

Netfoil doesn't decrement TTL
MEDIUM 5.8
Go

GO-2026-6836

SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized
CRITICAL 9.8
Go

GO-2026-6897

imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution
MEDIUM 6.5
Go

GO-2026-6894

anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS
UNKNOWN
Go

GO-2026-6907

Arc has unauthenticated application log disclosure via `/api/v1/logs`
MEDIUM 5.3
Go

GO-2026-6892

charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories
MEDIUM 5.9
Go

GO-2026-6891

charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users
HIGH 7.5
Go

GO-2026-6895

imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash
HIGH 7.5
Go

CVE-2026-118761

Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory
MEDIUM 5.9
Go

CVE-2026-118655

Echo has a Static Middleware Double-Unescape Path Traversal
CRITICAL 9.8
Go

CVE-2026-104252

Vitess vttablet /twopcz reflected XSS
MEDIUM 6.1
Go

CVE-2026-118652

Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob
UNKNOWN
Go

CVE-2026-107223

Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process
MEDIUM 5.3
Go

CVE-2026-118653

Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration
HIGH 7.4
Go

CVE-2026-113727

OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs
MEDIUM 5.9
Go

CVE-2026-118657

Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers
LOW 3.8
Go

CVE-2026-13322

KubeVirt downward metrics virtio-serial server vulnerable to unbounded memory consumption
MEDIUM 6.5
Go

CVE-2026-55098

Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735
HIGH 7.5
Go

CVE-2026-118759

Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logs
UNKNOWN
Go

CVE-2026-118260

Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo
UNKNOWN
Go

CVE-2026-118264

Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo
MEDIUM 6.5
Go

CVE-2026-107220

Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref
HIGH 8.6
Go

CVE-2026-116682

FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes