Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-34767Electron: HTTP Response Header Injection in custom protocol handlers and webRequestnpm · electron · fixed in 38.8.6, 39.8.3, 40.8.3 and more
- CVE-2026-34766Electron: USB device selection not validated against filtered device listnpm · electron · fixed in 38.8.6, 39.8.0, 40.7.0 and more
- CVE-2026-34769Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreferencenpm · electron · fixed in 38.8.6, 39.8.0, 40.7.0 and more
- CVE-2026-34511OpenClaw < 2026.4.2 - PKCE Verifier Exposure via OAuth State Parameternpm · openclaw · fixed in 2026.4.2
- CVE-2026-35216Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Stepnpm · @budibase/server · fixed in 3.33.4
- CVE-2026-35214Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file writenpm · @budibase/server · fixed in 3.33.4
- CVE-2026-31818Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklistnpm · @budibase/backend-core · fixed in 3.33.4
- CVE-2026-25044Budibase: Command Injection in Bash Automation Stepnpm · @budibase/server · fixed in 3.33.4
- CVE-2026-34825NocoBase Has SQL Injection via template variable substitution in workflow SQL nodenpm · @nocobase/plugin-workflow-sql · fixed in 2.0.30
- CVE-2026-34752Haraka affected by DoS via `__proto__` email headernpm · haraka · fixed in 3.1.4
- CVE-2026-34426OpenClaw - Approval Bypass via Environment Variable Normalizationnpm · openclaw · fixed in 2026.3.22, 2026.4.2
- CVE-2026-34425OpenClaw - Shell-Bleed Protection Preflight Validation Bypassnpm · openclaw · fixed in 2026.4.2
- CVE-2026-34725dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configurationnpm · dbgate-web · fixed in 7.1.5
- CVE-2026-34601xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertionnpm · @xmldom/xmldom, xmldom · fixed in 0.8.12, 0.9.9
- CVE-2026-34526SillyTavern: Incomplete IP validation in /api/search/visit allows SSRF via localhost and IPv6npm · sillytavern · fixed in 1.17.0
- CVE-2026-34524SillyTavern: Path traversal in `/api/chats/export` and `/api/chats/delete` allows arbitrary file read/delete within user data rootnpm · sillytavern · fixed in 1.17.0
- CVE-2026-34523SillyTavern: Path traversal allows file existence oraclenpm · sillytavern · fixed in 1.17.0
- CVE-2026-34522SillyTavern: Path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directorynpm · sillytavern · fixed in 1.17.0
- CVE-2026-35038signalk-server: Arbitrary Prototype Read via `from` Field Bypassnpm · signalk-server · fixed in 2.24.0
- CVE-2026-34083signalk-server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC Flownpm · signalk-server · fixed in 2.24.0
- CVE-2026-33951signalk-server: Unauthenticated Source Priorities Manipulationnpm · signalk-server · fixed in 2.24.0-beta.1
- CVE-2026-33950signalk-server: Privilege Escalation by Admin Role Injection via /enableSecuritynpm · signalk-server · fixed in 2.24.0-beta.4
- CVE-2026-5327efforthye fast-filesystem-mcp index.ts handleGetDiskUsage command injectionnpm · fast-filesystem-mcp
- CVE-2026-5323priyankark a11y-mcp index.js A11yServer server-side request forgerynpm · a11y-mcp · fixed in 1.0.5
- CVE-2026-34750Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpointsnpm · @payloadcms/storage-azure, @payloadcms/storage-gcs +2 · fixed in 3.78.0
- CVE-2026-34749Payload has a CSRF Protection Bypass in Authentication Flownpm · payload · fixed in 3.79.1
- CVE-2026-34748@payloadcms/next has Stored XSS in Admin Panelnpm · @payloadcms/next · fixed in 3.78.0
- CVE-2026-34747Payload has an SQL Injection via Query Handlingnpm · payload · fixed in 3.79.1
- CVE-2026-34746Payload has Authenticated SSRF via Upload Functionalitynpm · payload · fixed in 3.79.1
- CVE-2026-34751Payload has Unvalidated Input in Password Recovery Endpointsnpm · @payloadcms/graphql, payload · fixed in 3.79.1