Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-33539Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapternpm · parse-server · fixed in 9.6.0-alpha.53, 8.6.59
- CVE-2026-33538Parse Server: Denial of service via unindexed database query for unconfigured auth providersnpm · parse-server · fixed in 9.6.0-alpha.52, 8.6.58
- CVE-2026-33527Parse Server: Session update endpoint allows overwriting server-generated session fieldsnpm · parse-server · fixed in 9.6.0-alpha.48, 8.6.57
- CVE-2026-33508Parse Server: LiveQuery subscription query depth bypassnpm · parse-server · fixed in 9.6.0-alpha.45, 8.6.56
- CVE-2026-33498Parse Server: Query condition depth bypass via pre-validation transform pipelinenpm · parse-server · fixed in 9.6.0-alpha.44, 8.6.55
- CVE-2026-33429Parse Server: Protected field change detection oracle via LiveQuery watch parameternpm · parse-server · fixed in 9.6.0-alpha.43, 8.6.54
- CVE-2026-33421Parse Server: LiveQuery bypasses CLP pointer permission enforcementnpm · parse-server · fixed in 9.6.0-alpha.42, 8.6.53
- CVE-2026-33409Parse Server: Auth provider validation bypass on login via partial authDatanpm · parse-server · fixed in 9.6.0-alpha.41, 8.6.52
- CVE-2026-33323Parse Server: Email verification resend page leaks user existencenpm · parse-server · fixed in 9.6.0-alpha.40, 8.6.51
- CVE-2026-33418@dicebear/converter ensureSize() Vulnerable to SVG Dimension Capping Bypass via XML Comment Injectionnpm · @dicebear/converter · fixed in 9.4.2
- CVE-2026-33311@dicebear/core and @dicebear/initials Vulnerable to SVG Injection via Unsanitized Optionsnpm · @dicebear/core, @dicebear/initials · fixed in 5.4.4, 6.1.4, 7.1.4 and more
- CVE-2026-32913OpenClaw < 2026.3.7 - Custom Authorization Header Leakage via Cross-Origin Redirectsnpm · openclaw · fixed in 2026.3.7
- CVE-2026-27646OpenClaw < 2026.3.7 - Sandbox Escape via /acp spawn Commandnpm · openclaw · fixed in 2026.3.7
- CVE-2026-27183OpenClaw < 2026.3.7 - Shell Approval Gating Bypass via Dispatch Wrapper Depth Mismatchnpm · openclaw · fixed in 2026.3.7
- CVE-2026-3635Fastify request.protocol and request.host spoofable via X-Forwarded-Proto/Host from untrusted connections when trustProxy uses restrictive trust functionnpm · fastify · fixed in 5.8.3
- CVE-2026-4603Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in ext/rsa.jnpm · jsrsasign · fixed in 11.1.1
- CVE-2026-4601Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash pronpm · jsrsasign · fixed in 11.1.1
- CVE-2026-4599Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandonpm · jsrsasign · fixed in 11.1.1
- CVE-2026-4598Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInnpm · jsrsasign · fixed in 11.1.1
- CVE-2026-4602Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponenpm · jsrsasign · fixed in 11.1.1
- CVE-2026-4600Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-paramenpm · jsrsasign · fixed in 11.1.1
- CVE-2026-32899OpenClaw < 2026.2.25 - Sender Policy Bypass in Slack Reaction and Pin Event Handlersnpm · openclaw · fixed in 2026.2.25
- CVE-2026-32898OpenClaw < 2026.2.23 - ACP Permission Auto-Approval Bypass via Untrusted Tool Metadatanpm · openclaw · fixed in 2026.2.23
- CVE-2026-32897OpenClaw < 2026.2.22 - Authentication Token Reuse in Owner ID Prompt Hashing Fallbacknpm · openclaw · fixed in 2026.2.22
- CVE-2026-32896OpenClaw < 2026.2.21 - Unauthenticated Webhook Access via Passwordless Fallback in BlueBubbles Pluginnpm · openclaw · fixed in 2026.2.21
- CVE-2026-32895OpenClaw < 2026.2.26 - Sender Authorization Bypass in Slack System Event Handlersnpm · openclaw · fixed in 2026.2.26
- CVE-2026-32067OpenClaw < 2026.2.26 - Cross-Account Authorization Bypass in DM Pairing Storenpm · openclaw · fixed in 2026.2.26
- CVE-2026-32065OpenClaw < 2026.2.25 - Approval Identity Mismatch in system.run Command Executionnpm · openclaw · fixed in 2026.2.25
- CVE-2026-32064OpenClaw < 2026.2.21 - Missing VNC Authentication in Sandbox Browser noVNC Observernpm · openclaw · fixed in 2026.2.21
- CVE-2026-32058OpenClaw < 2026.2.26 - Approval Context-Binding Weakness in system.run via host=nodenpm · openclaw · fixed in 2026.2.26