Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-40248free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence SubscriptionsGo · github.com/free5gc/udr
- CVE-2026-40247free5gc UDR improper path validation allows unauthenticated access to Traffic Influence SubscriptionsGo · github.com/free5gc/udr
- CVE-2026-40246free5gc UDR improper path validation allows unauthenticated deletion of Traffic Influence SubscriptionsGo · github.com/free5gc/udr
- CVE-2026-40245Free5GC: UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authenticationGo · github.com/free5gc/udr
- CVE-2026-6383Kubevirt: kubevirt: unauthorized subresource access due to improper rbac evaluationGo · kubevirt.io/kubevirt
- CVE-2026-6290Velociraptor Query() Plugin Misapplies Permissions To OrgsGo · www.velocidex.com/golang/velociraptor
- CVE-2024-53412Command injection in the connect function in NietThijmen ShoppingCart 0.0.2 allows an attacker to execute arbitrary shell commands and achieGo · github.com/nietthijmen/shoppingcart
- CVE-2026-37980Org.keycloak.forms.login: keycloak: keycloak: arbitrary code execution via stored cross-site scripting (xss) in organization selection login pageMaven · org.keycloak:keycloak-services
- CVE-2026-34225Open WebUI has Blind Server Side Request Forgery in its Image Edit FunctionalityPyPI · open-webui
- CVE-2025-61260A vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context Protonpm · @openai/codex
- CVE-2026-38527A Server-Side Request Forgery (SSRF) in the /settings/webhooks/create component of Webkul Krayin CRM v2.2.x allows attackers to scan internaPackagist · krayin/laravel-crm
- CVE-2026-38529A Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attPackagist · krayin/laravel-crm
- CVE-2026-38530A Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticPackagist · krayin/laravel-crm
- CVE-2026-38532A Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php endpoint of Webkul Krayin CRM v2.2.x allows authentiPackagist · krayin/laravel-crm
- CVE-2026-34069nimiq-consensus panics via RequestMacroChain micro-block locatorcrates.io · nimiq-consensus
- CVE-2019-25710Dolibarr ERP-CRM 8.0.4 SQL Injection via rowid ParameterPackagist · dolibarr/dolibarr
- CVE-2026-6111FoundationAgents MetaGPT common.py decode_image server-side request forgeryPyPI · metagpt
- CVE-2026-6110FoundationAgents MetaGPT Tree-of-Thought Solver tot.py generate_thoughts code injectionPyPI · metagpt
- CVE-2026-6109FoundationAgents MetaGPT Mineflayer HTTP API index.js evaluateCode cross-site request forgeryPyPI · metagpt
- CVE-2026-5059aws-mcp-server AWS CLI Command Injection Remote Code Execution VulnerabilityPyPI · aws-mcp
- CVE-2026-40189goshs has a file-based ACL authorization bypass in goshs state-changing routesGo · github.com/patrickhener/goshs
- CVE-2026-40188goshs is Missing Write Protection for Parametric Data ValuesGo · github.com/patrickhener/goshs
- CVE-2026-35669OpenClaw < 2026.3.25 - Privilege Escalation via Gateway Plugin HTTP Authentication Scopenpm · openclaw
- CVE-2026-35663OpenClaw < 2026.3.25 - Privilege Escalation via Backend Reconnect Scope Self-Claimnpm · openclaw
- CVE-2026-35647OpenClaw < 2026.3.25 - Direct Message Policy Bypass via Verification Noticesnpm · openclaw
- CVE-2026-5986Zod jsVideoUrlParser util.js getTime redosnpm · js-video-url-parser
- CVE-2026-35642OpenClaw < 2026.3.25 - Authorization Bypass in Group Reactions via requireMention Bypassnpm · openclaw
- CVE-2026-35632OpenClaw < 2026.3.24 - Symlink Traversal via IDENTITY.md appendFile in agents.create/updatenpm · openclaw
- CVE-2026-35628OpenClaw < 2026.3.25 - Brute-Force Attack via Missing Telegram Webhook Rate Limitingnpm · openclaw
- CVE-2026-35625OpenClaw < 2026.3.25 - Privilege Escalation via Silent Local Shared-Auth Reconnectnpm · openclaw