Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-22174OpenClaw < 2026.2.22 - Gateway Token Disclosure via Chrome CDP Probenpm · openclaw · fixed in 2026.2.22
- CVE-2026-22171OpenClaw < 2026.2.19 - Path Traversal in Feishu Media Temporary File Namingnpm · openclaw · fixed in 2026.2.19
- CVE-2026-22170OpenClaw < 2026.2.22 BlueBubbles - Access Control Bypass via Empty allowFrom Configurationnpm · openclaw · fixed in 2026.2.22
- CVE-2026-22169OpenClaw < 2026.2.22 - Allowlist Bypass via sort Configuration in safeBinsnpm · openclaw · fixed in 2026.2.22
- CVE-2026-22168OpenClaw < 2026.2.21 - Command Injection via cmd.exe /c Trailing Arguments in system.runnpm · openclaw · fixed in 2026.2.21
- CVE-2026-29057Next.js: HTTP request smuggling in rewritesnpm · next · fixed in 16.1.7, 15.5.13
- CVE-2026-27980Next.js: Unbounded next/image disk cache growth can exhaust storagenpm · next · fixed in 16.1.7, 15.5.14
- CVE-2026-27979Next.js: Unbounded postponed resume buffering can lead to DoSnpm · next · fixed in 16.1.7
- CVE-2026-30048A stored cross-site scripting (XSS) vulnerability exists in the NotChatbot WebChat widget thru 1.4.4.npm · @developer.notchatbot/webchat
- CVE-2026-27978Next.js: null origin can bypass Server Actions CSRF checksnpm · next · fixed in 16.1.7
- CVE-2026-27977Next.js: null origin can bypass dev HMR websocket CSRF checksnpm · next · fixed in 16.1.7
- CVE-2026-4258Versions of the package sjcl before 1.0.9 are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve vnpm · sjcl · fixed in 1.0.9
- CVE-2026-32774Vulnogram - Stored Cross-Site Scripting via Comment Hypertextnpm · vulnogram
- CVE-2026-32732XSS in @leanprover/unicode-input-componentnpm · @leanprover/unicode-input-component · fixed in 0.2.0
- CVE-2026-32635Angular has XSS in i18n attribute bindingsnpm · @angular/compiler, @angular/core · fixed in 22.0.0-next.3, 21.2.4, 20.3.18 and more
- CVE-2026-32630file-type affected by ZIP Decompression Bomb DoS via [Content_Types].xml entrynpm · file-type · fixed in 21.3.2
- CVE-2026-32621Apollo Federation has prototype pollution via incomplete key sanitizationnpm · @apollo/federation-internals, @apollo/gateway +1 · fixed in 2.9.6, 2.10.5, 2.11.6 and more
- CVE-2026-32594Parse Server GraphQL WebSocket endpoint bypasses security middlewarenpm · parse-server · fixed in 9.6.0-alpha.14, 8.6.40
- CVE-2026-31882Dagu SSE Authentication Bypass in Basic Auth Modenpm · dagu · fixed in 2.2.4
- CVE-2026-26954SandboxJS has a Sandbox Escapenpm · @nyariv/sandboxjs · fixed in 0.8.34
- CVE-2026-4092Arbitrary File Write via Path Traversal in Google clasp leading to RCEnpm · @google/clasp · fixed in 3.2.0
- CVE-2026-32598OneUptime: Password Reset Token Logged at INFO Levelnpm · oneuptime · fixed in 10.0.23
- CVE-2026-32308OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose")npm · oneuptime · fixed in 10.0.23
- CVE-2026-32306OneUptime ClickHouse SQL Injection via Aggregate Query Parametersnpm · oneuptime · fixed in 10.0.23
- CVE-2026-32304Locutus: RCE via unsanitized input in create_function()npm · locutus · fixed in 3.0.14
- CVE-2026-32302OpenClaw: Untrusted web origins can obtain authenticated operator.admin access in trusted-proxy modenpm · openclaw · fixed in 2026.3.11
- CVE-2026-2229undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validationnpm · undici · fixed in 6.24.0, 7.24.0
- CVE-2026-1528undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the clientnpm · undici · fixed in 6.24.0, 7.24.0
- CVE-2026-1527undici is vulnerable to CRLF Injection via upgrade optionnpm · undici · fixed in 6.24.0, 7.24.0
- CVE-2026-2581undici is vulnerable to Unbounded Memory Consumption in in Undici's DeduplicationHandler via Response Buffering leads to DoSnpm · undici · fixed in 7.24.0