Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-32094Shescape escape() leaves bracket glob expansion active on Bash, BusyBox, and Dashnpm · shescape · fixed in 2.1.10
- CVE-2026-31901Parse Server has user enumeration via email verification endpointnpm · parse-server · fixed in 9.6.0-alpha.8, 8.6.34
- CVE-2026-31875Parse Server MFA recovery codes not consumed after usenpm · parse-server · fixed in 9.6.0-alpha.7, 8.6.33
- CVE-2026-31872Parse Server has a protected fields bypass via dot-notation in query and sortnpm · parse-server · fixed in 9.6.0-alpha.6, 8.6.32
- CVE-2026-31871Parse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQLnpm · parse-server · fixed in 9.6.0-alpha.5, 8.6.31
- CVE-2026-31868Parse Server has Stored XSS via file upload of HTML-renderable file typesnpm · parse-server · fixed in 9.6.0-alpha.4, 8.6.30
- CVE-2026-30226devalue has prototype pollution in devalue.parse and devalue.unflattennpm · devalue · fixed in 5.6.4
- CVE-2026-31975Cloud CLI WebSocket shell injectionnpm · @siteboon/claude-code-ui · fixed in 1.25.0
- CVE-2026-31861Shell Command Injection in Git Routes [CloudCLI UI]npm · @siteboon/claude-code-ui · fixed in 1.24.0
- CVE-2026-31862Cloud CLI has Command Injection via Multiple Parametersnpm · @siteboon/claude-code-ui, @siteboon/claudecodeui · fixed in 1.24.0
- CVE-2026-31856Parse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQLnpm · parse-server · fixed in 9.6.0-alpha.3, 8.6.29
- CVE-2026-31840Parse Server has a SQL injection via dot-notation field name in PostgreSQLnpm · parse-server · fixed in 9.6.0-alpha.2, 8.6.28
- CVE-2026-31839Striae has a hash validation utility vulnerabilitynpm · @striae-org/striae · fixed in 3.0.0
- CVE-2026-32063OpenClaw 2026.2.19-2 < 2026.2.21 - Command Injection via Newline in systemd Unit Generationnpm · openclaw · fixed in 2026.2.21
- CVE-2026-32062OpenClaw 2026.2.21-2 < 2026.2.22 - Unauthenticated WebSocket Resource Exhaustion via Media Streamnpm · @openclaw/voice-call, openclaw · fixed in 2026.2.22
- CVE-2026-32061OpenClaw < 2026.2.17 - Arbitrary File Read via $include Directive Path Traversalnpm · openclaw · fixed in 2026.2.17
- CVE-2026-32060OpenClaw < 2026.2.14 - Path Traversal in apply_patch via Crafted Pathsnpm · openclaw · fixed in 2026.2.14
- CVE-2026-32059OpenClaw 2026.2.22-2 < 2026.2.23 - Allowlist Bypass via sort Long-Option Abbreviation in tools.exec.safeBinsnpm · openclaw · fixed in 2026.2.23
- CVE-2026-31829Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Accessnpm · flowise, flowise-components · fixed in 3.0.13
- CVE-2026-31828Parse Server has an LDAP injection via unsanitized user input in DN and group filter constructionnpm · parse-server · fixed in 9.5.2-alpha.13, 8.6.26
- CVE-2026-31808file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-headernpm · file-type · fixed in 21.3.1
- CVE-2026-31800Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routesnpm · parse-server · fixed in 9.5.2-alpha.12, 8.6.25
- CVE-2026-30972Parse Server has a rate limit bypass via batch request endpointnpm · parse-server · fixed in 9.5.2-alpha.10, 8.6.23
- CVE-2026-30967Parse Server OAuth2 authentication adapter account takeover via identity spoofingnpm · parse-server · fixed in 9.5.2-alpha.9, 8.6.22
- CVE-2026-30966Parse Server role escalation and CLP bypass via direct `_Join` table writenpm · parse-server · fixed in 9.5.2-alpha.7, 8.6.20
- CVE-2026-30965Parse Server session token exfiltration via `redirectClassNameForKey` query parameternpm · parse-server · fixed in 9.5.2-alpha.8, 8.6.21
- CVE-2026-30962Parse Server has a protected fields bypass via logical query operatorsnpm · parse-server · fixed in 9.5.2-alpha.6, 8.6.19
- CVE-2026-30952liquidjs has a path traversal fallback vulnerabilitynpm · liquidjs · fixed in 10.25.0
- CVE-2026-30951Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Typenpm · sequelize · fixed in 6.37.8
- CVE-2026-30949Parse Server is missing audience validation in Keycloak authentication adapternpm · parse-server · fixed in 9.5.2-alpha.5, 8.6.18