Latest vulnerabilities
A live feed of the known-exploited and high-severity vulnerabilities Stateward watches for - drawn from CISA KEV and OSV, alongside the landmark npm supply-chain attacks and Web3 exploits that define the threat. The same intelligence Stateward checks your dependencies against, continuously. Provided with curated mitigation recommendations.
1888 advisories · 288 curated incidents · 2 sources · automated feed updated 2026-10-19
1888 shown
- HIGHSupply chainCVE-2026-96627Go · github.com/getarcaneapp/arcane/backend/v2
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
- MEDIUMSupply chainCVE-2026-96628Go · github.com/getarcaneapp/arcane/backend/v2
Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`
- CRITICALSupply chainCVE-2026-105192PyPI · lmcache
LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport
- HIGHSupply chainCVE-2026-100349Go · github.com/getkin/kin-openapi
kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content
- MEDIUMSupply chainCVE-2026-58494crates.io · wasmtime-wasi
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
- HIGHSupply chainGHSA-6fj4-rcr3-r7rrcrates.io · lopdf
lopdf has a stack overflow via deeply nested PDF objects
- HIGHSupply chainCVE-2026-102834Maven · org.bytedeco:javacv
JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS
- CRITICALSupply chainCVE-2026-96620PyPI · claude-agent-sdk
Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution
- HIGHSupply chainCVE-2026-102941Go · github.com/gomarkdown/markdown
gomarkdown/markdown IsSafeURL panics on short URLs
- CRITICALSupply chainCVE-2026-102989npm · @tanstack/start-server-core
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
- MEDIUMSupply chainCVE-2026-102682PyPI · pipecat-ai
Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation
- CRITICALSupply chainCVE-2026-94603Go · github.com/containers/podman
Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation
- MEDIUMSupply chainCVE-2026-102832PyPI · jupyterlab
JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked
- MEDIUMSupply chainCVE-2026-103028Go · github.com/drakkan/sftpgo/v2
SFTPGo source-side file-pattern filter bypass during copy operations
- HIGHSupply chainCVE-2026-86063npm · @anthropic-ai/claude-code
Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning
- MEDIUMSupply chainCVE-2026-95838Go · github.com/containerd/containerd/v2
containerd: Unpack DoS via repeated opaque whiteouts
- MEDIUMSupply chainCVE-2026-85747Go · github.com/docker/distribution
Distribution: Client `manifests.Get()` does not verify returned content against requested digest
- HIGHSupply chainCVE-2026-84994npm · @builder.io/qwik
Qwik: Crashing any Qwik Server via Resource thenable
- HIGHSupply chainCVE-2026-95837Go · github.com/containerd/containerd/v2
containerd CRI plugin: Checkpoint restore bypasses destination security context
- MEDIUMSupply chainCVE-2026-106495npm · @backstage/backend-defaults
Backstage: Improper access control in backend action invocation
- HIGHSupply chainCVE-2026-100353Go · github.com/getkin/kin-openapi
kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter
- HIGHSupply chainCVE-2026-100354Go · github.com/getkin/kin-openapi
kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash
- HIGHSupply chainCVE-2026-100352Go · github.com/getkin/kin-openapi
kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path
- CRITICALSupply chainCVE-2026-77524Go · github.com/kedacore/keda
KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication
- CRITICALSupply chainCVE-2026-77459Go · github.com/argoproj/argo-cd/v2
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
- HIGHSupply chainCVE-2026-100351Go · github.com/getkin/kin-openapi
kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion
- MEDIUMSupply chainCVE-2026-103975npm · @appium/support
Appium: Symlink based Zip Slip in @appium/support ZIP extraction
- MEDIUMSupply chainCVE-2026-100350Go · github.com/getkin/kin-openapi
kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression
- CRITICALSupply chainCVE-2026-102748Go · github.com/dgraph-io/dgraph/v25
Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service
- MEDIUMSupply chainCVE-2026-104266PyPI · tinytag
tinytag: Infinite loop when parsing certain M4A files containing invalid atoms
- MEDIUMSupply chainCVE-2026-104102PyPI · copyparty
copyparty FTP: upload outside defined volumes (limited path traversal)
- CRITICALSupply chainCVE-2026-104252Go · vitess.io/vitess
Vitess vttablet /twopcz reflected XSS
- MEDIUMSupply chainCVE-2026-104250PyPI · unstructured
unstructured: Stored XSS via unescaped HTML generation
- HIGHSupply chainCVE-2026-103929crates.io · mise
mise permits untrusted local configuration to override default shell arguments
- MEDIUMSupply chainCVE-2026-100348Go · github.com/getkin/kin-openapi
kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)
- MEDIUMSupply chainCVE-2026-100347Go · github.com/getkin/kin-openapi
kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path
Get the weekly threat digest
New known-exploited vulnerabilities and landmark attacks, each with the fix, in your inbox. No spam, unsubscribe anytime.
Stateward checks your dependencies against this intelligence on every pull request, and tells you only what actually reaches your code.
See it on your repo