Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-32922OpenClaw < 2026.3.11 - Privilege Escalation via Unvalidated Scope in device.token.rotatenpm · openclaw · fixed in 2026.3.11
- CVE-2026-32919OpenClaw < 2026.3.11 - Unauthorized Session Reset via agent Slash Commandsnpm · openclaw · fixed in 2026.3.11
- CVE-2026-32918OpenClaw < 2026.3.11 - Session Sandbox Escape via session_status Toolnpm · openclaw · fixed in 2026.3.11
- CVE-2026-32915OpenClaw < 2026.3.11 - Sandbox Boundary Bypass via Subagent Control Surfacenpm · openclaw · fixed in 2026.3.11
- CVE-2026-32914OpenClaw < 2026.3.12 - Insufficient Access Control in /config and /debug Endpointsnpm · openclaw · fixed in 2026.3.12
- CVE-2026-33994Locutus Prototype Pollution due to incomplete fix for CVE-2026-25521npm · locutus · fixed in 3.0.25
- CVE-2026-33993Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()npm · locutus · fixed in 3.0.25
- CVE-2026-33989@mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen capture toolsnpm · @mobilenext/mobile-mcp · fixed in 0.0.49
- CVE-2026-33979Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)npm · express-xss-sanitizer · fixed in 2.0.2
- CVE-2026-34226Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookiesnpm · happy-dom · fixed in 20.8.9
- CVE-2026-33943Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable codenpm · happy-dom · fixed in 20.8.8
- CVE-2026-33941Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Optionsnpm · handlebars · fixed in 4.7.9
- CVE-2026-33940Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partialnpm · handlebars · fixed in 4.7.9
- CVE-2026-33939Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilationnpm · handlebars · fixed in 4.7.9
- CVE-2026-33938Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-blocknpm · handlebars · fixed in 4.7.9
- CVE-2026-33937Handlebars.js has JavaScript Injection via AST Type Confusionnpm · handlebars · fixed in 4.7.9
- CVE-2026-33916Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injectionnpm · handlebars · fixed in 4.7.9
- CVE-2026-33896Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)npm · node-forge · fixed in 1.4.0
- CVE-2026-33895Forge has signature forgery in Ed25519 due to missing S > L checknpm · node-forge · fixed in 1.4.0
- CVE-2026-33894Forge has signature forgery in RSA-PKCS due to ASN.1 extra fieldnpm · node-forge · fixed in 1.4.0
- CVE-2026-33891Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Inputnpm · node-forge · fixed in 1.4.0
- CVE-2026-33750brace-expansion: Zero-step sequence causes process hang and memory exhaustionnpm · brace-expansion · fixed in 5.0.5, 3.0.2, 2.0.3 and more
- CVE-2026-33672Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matchingnpm · picomatch · fixed in 4.0.4, 3.0.2, 2.3.2
- CVE-2026-33671Picomatch has a ReDoS vulnerability via extglob quantifiersnpm · picomatch · fixed in 4.0.4, 3.0.2, 2.3.2
- CVE-2026-33532yaml is vulnerable to Stack Overflow via deeply nested YAML collectionsnpm · yaml · fixed in 2.8.3, 1.10.3
- CVE-2026-4923path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcardsnpm · path-to-regexp · fixed in 8.4.0
- CVE-2026-4926path-to-regexp vulnerable to Denial of Service via sequential optional groupsnpm · path-to-regexp · fixed in 8.4.0
- CVE-2026-33732srvx is vulnerable to middleware bypass via absolute URI in request linenpm · srvx · fixed in 0.11.13
- CVE-2026-33490h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routesnpm · h3 · fixed in 2.0.1-rc.17
- CVE-2026-33468Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that append string literal values into the compiled SQL stringsnpm · kysely · fixed in 0.28.14