Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-53830OpenClaw < 2026.4.22 - Webhook Secret Revocation Bypass via secrets.reloadnpm · openclaw · fixed in 2026.4.22
- CVE-2026-53829OpenClaw < 2026.5.18 - Command Truncation in Exec Approval Displaynpm · openclaw · fixed in 2026.5.18
- CVE-2026-53828OpenClaw < 2026.5.6 - Native Command Authorization Bypass via Owner-Command Enforcementnpm · openclaw · fixed in 2026.5.6
- CVE-2026-53827OpenClaw < 2026.5.2 - Credential Exposure via Model-Supplied Loopback URLs in message.action Forwardingnpm · openclaw · fixed in 2026.5.2
- CVE-2026-53826OpenClaw < 2026.4.26 - Information Disclosure via Sandboxed Session Spawnnpm · openclaw · fixed in 2026.4.26
- CVE-2026-53825OpenClaw < 2026.4.7 - Arbitrary Local File Read via memory-wiki Ingest with operator.write Scopenpm · openclaw · fixed in 2026.5.12
- CVE-2026-53824Mattermost plugin for OpenClaw < 2026.4.24 - Slash Token Revocation Lag via Monitor Refresh Delaynpm · openclaw · fixed in 2026.4.24
- CVE-2026-53823OpenClaw < 2026.5.3 - Privilege Escalation via Mutable Slack Display Names in allowFromnpm · openclaw · fixed in 2026.5.3
- CVE-2026-53822OpenClaw < 2026.5.18 - Command Argument Modification via Shell Wrapper Between Approval and Executionnpm · openclaw · fixed in 2026.5.18
- CVE-2026-53821OpenClaw < 2026.5.18 - Scope Elevation in trusted-proxy Control UI WebSocketnpm · openclaw · fixed in 2026.5.18
- CVE-2026-53820OpenClaw < 2026.5.12 - Exec Denylist Bypass in Bundle MCP Loopback Session Spawnnpm · openclaw · fixed in 2026.5.12
- CVE-2026-53609Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypassnpm · apostrophe · fixed in 4.31.0
- CVE-2026-53608@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tagnpm · @apostrophecms/seo · fixed in 1.5.0
- CVE-2026-53607@apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host headernpm · apostrophe · fixed in 4.31.0
- CVE-2026-53606sanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and background attributesnpm · sanitize-html · fixed in 2.17.5
- CVE-2026-45013Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validationnpm · apostrophe
- CVE-2026-45012Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widgetnpm · apostrophe
- CVE-2026-45011Apostrophe has stored XSS via javascript: URL in Image Widget Linknpm · apostrophe
- CVE-2026-44990Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`npm · sanitize-html · fixed in 2.17.4
- CVE-2026-42853@apostrophecms/cli: Command Injection in apos create via Unsanitized Password Inputnpm · @apostrophecms/cli
- CVE-2026-42890actual Allows Electron to Run As Nodenpm · actual · fixed in 26.5.0
- CVE-2026-50287Missing Authentication for Critical Function in @agenticmail/mcpnpm · @agenticmail/mcp · fixed in 0.9.27
- CVE-2026-53726Parse Server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACLnpm · parse-server · fixed in 9.9.1-alpha.6, 8.6.80
- CVE-2026-53725Parse Server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is deniednpm · parse-server · fixed in 9.9.1-alpha.5
- CVE-2026-53724Parse Server: Stored XSS via trailing-dot filename bypassing file upload extension blocklistnpm · parse-server · fixed in 9.9.1-alpha.4, 8.6.79
- CVE-2026-50008Parse Server: Server option routeAllowList is bypassable through batch sub-requestsnpm · parse-server · fixed in 9.9.1-alpha.3
- CVE-2026-47138Parse Server: Pre-authentication denial of service via client version header regex backtrackingnpm · parse-server · fixed in 9.9.1-alpha.1, 8.6.77
- CVE-2026-47248Parse Server: GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callersnpm · parse-server · fixed in 9.9.1-alpha.2, 8.6.78
- CVE-2026-12143form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)npm · form-data · fixed in 2.5.6, 3.0.5, 4.0.6
- CVE-2026-47141vm2: NodeVM observability builtins leak host process and HTTP request datanpm · vm2 · fixed in 3.11.4