Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-41329OpenClaw < 2026.3.31 - Sandbox Bypass via Heartbeat Context Inheritance and senderIsOwner Escalationnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41303OpenClaw < 2026.3.28 - Authorization Bypass in Discord Text Approval Commandsnpm · openclaw · fixed in 2026.3.28
- CVE-2026-41302OpenClaw < 2026.3.31 - Server-Side Request Forgery via Unguarded fetch() in Marketplace Plugin Downloadnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41301OpenClaw 2026.3.22 < 2026.3.31 - Forged Nostr DM Pairing State Creation via Signature Verification Bypassnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41300OpenClaw < 2026.3.31 - Preservation of Attacker-Discovered Endpoints in Remote Onboardingnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41299OpenClaw < 2026.3.28 - Client Identity Spoofing in chat.send Gateway Provenance Guardnpm · openclaw · fixed in 2026.3.28
- CVE-2026-41298OpenClaw < 2026.4.2 - Authorization Bypass in Session Termination Endpointnpm · openclaw · fixed in 2026.4.2
- CVE-2026-41297OpenClaw < 2026.3.31 - Server-Side Request Forgery via Marketplace Plugin Download Redirectnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41296OpenClaw < 2026.3.31 - Sandbox Escape via TOCTOU Race in Remote FS Bridge readFilenpm · openclaw · fixed in 2026.3.31
- CVE-2026-41295OpenClaw < 2026.4.2 - Untrusted Workspace Channel Shadow Code Execution during Built-in Channel Setupnpm · openclaw · fixed in 2026.4.2
- CVE-2026-41294OpenClaw < 2026.3.28 - Environment Variable Injection via CWD .env Filenpm · openclaw · fixed in 2026.3.28
- CVE-2026-40045OpenClaw < 2026.4.2 - Cleartext Credential Transmission via Unencrypted WebSocket Gateway Endpointsnpm · openclaw · fixed in 2026.4.2
- CVE-2026-41389OpenClaw 2026.4.7 < 2026.4.15 - Arbitrary File Read via Unvalidated Tool-Result Media Pathsnpm · openclaw · fixed in 2026.4.15
- CVE-2026-6594brikcss merge prototype pollutionnpm · @brikcss/merge
- CVE-2026-41242protobufjs has an arbitrary code execution issuenpm · protobufjs · fixed in 8.0.1, 7.5.5, 6.11.6
- CVE-2026-40346NocoBase has SSRF in Workflow HTTP Request and Custom Request Pluginsnpm · @nocobase/plugin-workflow-request · fixed in 2.0.37
- CVE-2026-40155Auth0 Next.js SDK has Improper Proxy Cache Lookupnpm · @auth0/nextjs-auth0 · fixed in 4.18.0
- CVE-2026-40299next-intl has an open redirect vulnerabilitynpm · next-intl · fixed in 4.9.1
- CVE-2026-35603Claude Code: Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on Windowsnpm · @anthropic-ai/claude-code · fixed in 2.1.75
- CVE-2026-40255@adonisjs/http-server has an Open Redirect vulnerabilitynpm · @adonisjs/core, @adonisjs/http-server · fixed in 7.3.1, 8.2.0, 7.8.1
- CVE-2026-39313MCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transportnpm · mcp-framework · fixed in 0.2.22
- CVE-2026-33804@fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes optionnpm · @fastify/middie · fixed in 9.3.2
- CVE-2026-6270@fastify/middie vulnerable to middleware authentication bypass in child plugin scopesnpm · @fastify/middie · fixed in 9.3.2
- CVE-2026-6410@fastify/static vulnerable to path traversal in directory listingnpm · @fastify/static · fixed in 9.1.1
- CVE-2026-6414@fastify/static vulnerable to route guard bypass via encoded path separatorsnpm · @fastify/static · fixed in 9.1.1
- CVE-2026-40186ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elementsnpm · sanitize-html · fixed in 2.17.3
- CVE-2026-39857Information Disclosure via `choices`/`counts` Query Parameters Bypassing publicApiProjection Field Restrictionsnpm · apostrophe · fixed in 4.29.0
- CVE-2026-35569ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMSnpm · apostrophe · fixed in 4.29.0
- CVE-2026-33889ApostropheCMS: Stored XSS via CSS Custom Property Injection in `@apostrophecms/color-field` Escaping Style Tag Contextnpm · apostrophe · fixed in 4.29.0
- CVE-2026-33888ApostropheCMS: publicApiProjection Bypass via `project` Query Builder in Piece-Type REST APInpm · apostrophe · fixed in 4.29.0