2 known vulnerabilities.
0 direct dependencies
none carry a known advisory
0 packages depend on it
an advisory here reaches each of them
Tracked for PyPI packages. HuggingFace models declare Python dependencies, so go packages are not covered.
severity out of 10
chance of exploitation in 30 days
CyberXYZ composite out of 10
fig. 01 — GHSA-vgrc-hq28-p3xp, the advisory selected below
Hysteria has an authenticated UDP ACL bypass that enables localhost and private-network UDP SSRF in github.com/apernet/hysteria/core.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: .
Checked 2026-10-01 at 00:05 UTC. The most recent advisory here was published 2026-07-07. Updated continuously from NVD, GHSA, OSV and CNA feeds.