Start for Free

Know every threat before it ships

200K+ vulnerabilities, malicious packages, and supply chain threats enriched with Corgea's research.

All npm PyPI Go NuGet crates.io Maven RubyGems

42,019 vulnerabilities

CRITICAL 9.9
Go

CVE-2026-48769

Incus has an arbitrary file write on its client due to trusted image hash
CRITICAL 9.9
Go

CVE-2026-48755

Incus has an argument injection in backup compression algorithm leading to AFW and ACE
CRITICAL 9.9
Go

CVE-2026-48752

Incus has arbitrary file read+write on host via templates/ symlink in malicious image
CRITICAL 9.9
Go

CVE-2026-48749

Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image
HIGH 7.5
Go

GO-2026-6898

imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field
UNKNOWN
Go

GO-2026-6906

Netfoil doesn't decrement TTL
MEDIUM 5.8
Go

GO-2026-6836

SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized
CRITICAL 9.8
Go

GO-2026-6897

imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution
MEDIUM 6.5
Go

GO-2026-6894

anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS
UNKNOWN
Go

GO-2026-6907

Arc has unauthenticated application log disclosure via `/api/v1/logs`
MEDIUM 5.3
Go

GO-2026-6892

charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories
MEDIUM 5.9
Go

GO-2026-6891

charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users
HIGH 7.5
Go

GO-2026-6895

imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash
HIGH 7.5
Go

CVE-2026-118761

Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory
MEDIUM 5.9
Go

CVE-2026-118655

Echo has a Static Middleware Double-Unescape Path Traversal
CRITICAL 9.8
Go

CVE-2026-104252

Vitess vttablet /twopcz reflected XSS
MEDIUM 6.1
Go

CVE-2026-118652

Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob
UNKNOWN
Go

CVE-2026-107223

Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process
MEDIUM 5.3
Go

CVE-2026-118653

Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration
HIGH 7.4
Go

CVE-2026-113727

OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs
MEDIUM 5.9
Go

CVE-2026-118657

Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers
LOW 3.8
Go

CVE-2026-13322

KubeVirt downward metrics virtio-serial server vulnerable to unbounded memory consumption
MEDIUM 6.5
Go

CVE-2026-55098

Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735
HIGH 7.5
Go

CVE-2026-118759

Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logs
UNKNOWN
Go

CVE-2026-118260

Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo
UNKNOWN
Go

CVE-2026-118264

Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo
MEDIUM 6.5
Go

CVE-2026-107220

Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref
HIGH 8.6
Go

CVE-2026-116682

FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory
MEDIUM 5.3
Go

CVE-2026-118266

Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method
HIGH 7.5
Go

CVE-2026-100354

kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash
UNKNOWN
Go

CVE-2026-116683

CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values
MEDIUM 5.8
Go

CVE-2026-73049

SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers
MEDIUM 5.3
Go

CVE-2026-100348

kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)
MEDIUM 5.3
Go

CVE-2026-107218

Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics
MEDIUM 6.5
Go

CVE-2026-107225

Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml
MEDIUM 6.5
Go

CVE-2026-107221

Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read API
MEDIUM 4.7
Go

CVE-2026-118658

Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto
UNKNOWN
Go

CVE-2026-118263

Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests in github.com/labstack/echo
UNKNOWN
Go

CVE-2026-62160

Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware
HIGH 7.4
Go

CVE-2026-100351

kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion
UNKNOWN
Go

CVE-2026-116591

compress zstd: Panic on two-block frames
CRITICAL 9.3
Go

CVE-2026-105769

kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts
HIGH 8.2
Go

CVE-2026-62331

praktor: Path traversal in Telegram file uploads allows writing outside the agent workspace uploads/ directory (stored instruction injection)
UNKNOWN
Go

CVE-2026-34157

Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins
MEDIUM 6.6
Go

CVE-2026-62204

SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin
MEDIUM 5.9
Go

CVE-2026-118654

Echo static file middleware route protection bypass via encoded dot-dot traversal
MEDIUM 5.3
Go

CVE-2026-100350

kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression
HIGH 7.5
Go

CVE-2026-107219

Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile
MEDIUM 5.3
Go

CVE-2026-100347

kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path
CRITICAL 9.8
PyPI KEV

CVE-2026-111497

Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package
MEDIUM 6.5
Go

CVE-2026-54462

knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion
UNKNOWN
Go

CVE-2026-118265

Echo: X-Real-IP extractor trusts the header value instead of the sending peer in github.com/labstack/echo

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes