Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-34076Clerk JavaScript: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended hostnpm · @clerk/backend, @clerk/express +2 · fixed in 3.2.3, 2.0.7, 3.1.5 and more
- CVE-2026-2265Replicator 1.0.5 is vulnerable to Remote Code Execution through Insecure Deserializationnpm · replicator
- CVE-2026-34603@tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctionsnpm · @tinacms/graphql · fixed in 2.2.2
- CVE-2026-34604@tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or Junctionsnpm · @tinacms/graphql · fixed in 2.2.2
- CVE-2026-33949@tinacms/graphql has Path Traversal that leads to overwrite of arbitrary filesnpm · @tinacms/graphql · fixed in 2.2.2
- CVE-2026-34510OpenClaw < 2026.3.22 - Remote File URL Acceptance in Windows Media Loadersnpm · openclaw · fixed in 2026.4.2, 2026.3.22
- CVE-2026-34451Claude SDK for TypeScript: Memory Tool Path Validation Allows Sandbox Escape to Sibling Directoriesnpm · @anthropic-ai/sdk · fixed in 0.81.0
- CVE-2026-34405Nuxt OG Image vulnerable to reflected XSS via query parameter injection into HTML attributesnpm · nuxt-og-image · fixed in 6.2.5
- CVE-2026-34404Nuxt OG Image vulnerable to DoS via image generationnpm · nuxt-og-image · fixed in 6.2.5
- CVE-2026-34784Parse Server: Streaming file download bypasses afterFind file trigger authorizationnpm · parse-server · fixed in 9.7.1-alpha.1, 8.6.71
- CVE-2026-34215Parse Server: Auth data exposed via verify password endpointnpm · parse-server · fixed in 9.7.0-alpha.7, 8.6.63
- CVE-2026-4800lodash vulnerable to Code Injection via `_.template` imports key namesnpm · lodash, lodash-amd +2 · fixed in 4.18.0
- CVE-2026-2950lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`npm · lodash, lodash-amd +2 · fixed in 4.18.0
- CVE-2026-34220MikroORM is vulnerable to SQL Injection via specially crafted objectnpm · @mikro-orm/core · fixed in 6.6.10, 7.0.6
- CVE-2026-34221MikroORM has Prototype Pollution in Utils.mergenpm · @mikro-orm/core · fixed in 6.6.10, 7.0.6
- CVE-2026-34595Parse Server: LiveQuery protected-field guard bypass via array-like logical operator valuenpm · parse-server · fixed in 9.7.0-alpha.16, 8.6.70
- CVE-2026-34574Parse Server: Session field immutability bypass via falsy-value guardnpm · parse-server · fixed in 9.7.0-alpha.14, 8.6.69
- CVE-2026-34573Parse Server: GraphQL complexity validator exponential fragment traversal DoSnpm · parse-server · fixed in 9.7.0-alpha.12, 8.6.68
- CVE-2026-34532Parse Server: Cloud function validator bypass via prototype chain traversalnpm · parse-server · fixed in 9.7.0-alpha.11, 8.6.67
- CVE-2026-34373Parse Server: GraphQL API endpoint ignores CORS origin restrictionnpm · parse-server · fixed in 9.7.0-alpha.10, 8.6.66
- CVE-2026-34363Parse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribersnpm · parse-server · fixed in 9.7.0-alpha.9, 8.6.65
- CVE-2026-34224Parse Server: MFA single-use token bypass via concurrent authData login requestsnpm · parse-server · fixed in 9.7.0-alpha.8, 8.6.64
- CVE-2026-34209mppx: Tempo has a session close voucher bypass vulnerability due to settled amount equalitynpm · mppx · fixed in 0.4.11
- CVE-2026-34504OpenClaw < 2026.3.28 - Server-Side Request Forgery via Unguarded Image Download in fal Providernpm · openclaw · fixed in 2026.3.28
- CVE-2026-34503OpenClaw < 2026.3.28 - Incomplete WebSocket Session Termination on Device Removal and Token Revocationnpm · openclaw · fixed in 2026.3.28
- CVE-2026-33581OpenClaw < 2026.3.24 - Arbitrary File Read via mediaUrl and fileUrl Parametersnpm · openclaw · fixed in 2026.3.24
- CVE-2026-33580OpenClaw < 2026.3.28 - Brute Force Attack via Missing Rate Limiting on Webhook Shared Secret Authenticationnpm · openclaw · fixed in 2026.3.28
- CVE-2026-33579OpenClaw < 2026.3.28 - Privilege Escalation via Missing Caller Scope Validation in Device Pair Approvalnpm · openclaw · fixed in 2026.3.28
- CVE-2026-33578OpenClaw < 2026.3.28 - Sender Policy Allowlist Bypass via Policy Downgrade in Google Chat and Zalouser Extensionsnpm · openclaw · fixed in 2026.3.28
- CVE-2026-33577OpenClaw < 2026.3.28 - Insufficient Scope Validation in node.pair.approvenpm · openclaw · fixed in 2026.3.28