Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-22176OpenClaw < 2026.2.19 - Command Injection via Unescaped Environment Variables in Windows Scheduled Task Script Generationnpm · openclaw · fixed in 2026.2.19
- CVE-2026-32731ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extractionnpm · @apostrophecms/import-export · fixed in 3.5.3
- CVE-2026-32730ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middlewarenpm · apostrophe · fixed in 4.28.0
- CVE-2026-33163Parse Server leaks protected fields via LiveQuery afterEvent triggernpm · parse-server · fixed in 9.6.0-alpha.35, 8.6.50
- CVE-2026-33042Parse Server affected by empty authData bypassing credential requirement on signupnpm · parse-server · fixed in 9.6.0-alpha.29, 8.6.49
- CVE-2026-32944Parse Server crash via deeply nested query condition operatorsnpm · parse-server · fixed in 9.6.0-alpha.21, 8.6.45
- CVE-2026-32943Parse Server has a password reset token single-use bypass via concurrent requestsnpm · parse-server · fixed in 9.6.0-alpha.28, 8.6.48
- CVE-2026-32886Parse Server's Cloud function dispatch crashes server via prototype chain traversalnpm · parse-server · fixed in 9.6.0-alpha.24, 8.6.47
- CVE-2026-32878Parse Server vulnerable to schema poisoning via prototype pollution in deep copynpm · parse-server · fixed in 9.6.0-alpha.20, 8.6.44
- CVE-2026-32770Parse Server: LiveQuery subscription with invalid regular expression crashes servernpm · parse-server · fixed in 9.6.0-alpha.19, 8.6.43
- CVE-2026-32742Parse Server session creation endpoint allows overwriting server-generated session fieldsnpm · parse-server · fixed in 9.6.0-alpha.17, 8.6.42
- CVE-2026-32728Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entriesnpm · parse-server · fixed in 9.6.0-alpha.15, 8.6.41
- CVE-2026-32723SandboxJS timers have an execution-quota bypass (cross-sandbox currentTicks race)npm · @nyariv/sandboxjs · fixed in 0.8.35
- CVE-2026-32638StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokensnpm · studiocms · fixed in 0.4.4
- CVE-2026-32256music-metadata has an infinite loop vulnerability in ASF parsernpm · music-metadata · fixed in 11.12.3
- CVE-2026-31938jsPDF has HTML Injection in New Window pathsnpm · jspdf · fixed in 4.2.1
- CVE-2026-31898jsPDF has a PDF Object Injection via FreeText colornpm · jspdf · fixed in 4.2.1
- CVE-2026-31865Elysia Cookie Value Prototype Pollutionnpm · elysia · fixed in 1.4.27
- CVE-2026-29112@dicebear/converter vulnerable to ncontrolled memory allocation via crafted SVG dimensionsnpm · @dicebear/converter · fixed in 9.4.0
- CVE-2026-27545OpenClaw < 2026.2.26 - Approval Bypass via Parent Symlink Current Working Directory Rebindnpm · openclaw · fixed in 2026.2.26
- CVE-2026-27524OpenClaw < 2026.2.21 - Prototype Pollution via Debug Override Pathnpm · openclaw · fixed in 2026.2.21
- CVE-2026-27523OpenClaw < 2026.2.24 - Sandbox Bind Validation Bypass via Symlink-Parent Missing-Leaf Pathsnpm · openclaw · fixed in 2026.2.24
- CVE-2026-27522OpenClaw < 2026.2.24 - Arbitrary File Read via sendAttachment and setGroupIcon Message Actionsnpm · openclaw · fixed in 2026.2.24
- CVE-2026-22217OpenClaw 2026.2.22 < 2026.2.23 - Arbitrary Binary Execution via $SHELL Environment Variable Trusted Prefix Fallbacknpm · openclaw · fixed in 2026.2.23
- CVE-2026-22181OpenClaw < 2026.3.2 - DNS Pinning Bypass via Environment Proxy Configuration in web_fetchnpm · openclaw · fixed in 2026.3.2
- CVE-2026-22180OpenClaw < 2026.3.2 - Path Confinement Bypass in Browser Output and File Write Operationsnpm · openclaw · fixed in 2026.3.2
- CVE-2026-22179OpenClaw < 2026.2.22 - Allowlist Bypass via Command Substitution in system.runnpm · openclaw · fixed in 2026.2.22
- CVE-2026-22178OpenClaw < 2026.2.19 - ReDoS and Regex Injection via Unescaped Feishu Mention Metadatanpm · openclaw · fixed in 2026.2.19
- CVE-2026-22177OpenClaw < 2026.2.21 - Environment Variable Injection via Config env.varsnpm · openclaw · fixed in 2026.2.21
- CVE-2026-22175OpenClaw < 2026.2.23 - Exec Approval Bypass via Unrecognized Multiplexer Shell Wrappersnpm · openclaw · fixed in 2026.2.23