Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-35623OpenClaw < 2026.3.25 - Brute-Force Attack via Missing Webhook Password Rate Limitingnpm · openclaw
- CVE-2026-34512OpenClaw < 2026.3.25 - Improper Access Control in /sessions/:sessionKey/kill Endpointnpm · openclaw
- CVE-2026-40093nimiq-blockchain is missing a wall-clock upper bound on block timestampscrates.io · nimiq-blockchain
- CVE-2026-5974FoundationAgents MetaGPT terminal.py Bash.run os command injectionPyPI · metagpt
- CVE-2026-5973FoundationAgents MetaGPT common.py get_mime_type os command injectionPyPI · metagpt
- CVE-2026-5971FoundationAgents MetaGPT XML action_node.py ActionNode.xml_fill eval injectionPyPI · metagpt
- CVE-2026-5970FoundationAgents MetaGPT HumanEvalBenchmark/MBPPBenchmark check_solution code injectionPyPI · metagpt
- CVE-2025-14551Senstive information disclosure was affecting subiquityPyPI · subiquity
- CVE-2026-34179Update of type field in restricted TLS certificate allows privilege escalation to cluster adminGo · github.com/canonical/lxd
- CVE-2026-34178Importing a crafted backup leads to project restriction bypassGo · github.com/canonical/lxd
- CVE-2026-34177VM lowlevel restriction bypass via raw.apparmor and raw.qemu.confGo · github.com/canonical/lxd
- CVE-2026-5833awwaiid mcp-server-taskwarrior index.ts server.setRequestHandler command injectionnpm · mcp-server-taskwarrior
- CVE-2026-5832atototo api-lab-mcp HTTP http-server.ts test_http_endpoint server-side request forgerynpm · api-lab-mcp
- CVE-2026-40035Unfurl - Werkzeug Debugger Exposure via String Config ParsingPyPI · dfir-unfurl
- CVE-2026-39414MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV ParsingGo · github.com/minio/minio
- CVE-2026-1163Insufficient Session Expiration in parisneo/lollmsPyPI · lollms
- CVE-2026-39370WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732)Packagist · wwbn/avideo
- CVE-2026-39369WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLsPackagist · wwbn/avideo
- CVE-2026-39368WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal servicesPackagist · wwbn/avideo
- CVE-2026-39367WWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG PagePackagist · wwbn/avideo
- CVE-2026-39366WWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.phpPackagist · wwbn/avideo
- CVE-2026-5739PowerJob OpenAPI Endpoint addWorkflowNode GroovyEvaluator.evaluate code injectionMaven · tech.powerjob:powerjob-server-starter
- CVE-2026-39360RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltrationcrates.io · rustfs
- CVE-2026-5736PowerJob detailPlus Endpoint InstanceController.java sql injectionMaven · tech.powerjob:powerjob-server-starter
- CVE-2026-35464pyLoad has an incomplete fix for CVE-2026-33509: unprotected storage_folder enables arbitrary file write to Flask session store and code executionPyPI · pyload-ng
- CVE-2025-56015In GenieACS 1.2.13, an unauthenticated access vulnerability exists in the NBI API endpoint.npm · genieacs
- CVE-2025-70844yaffa v2.0.0 is vulnerable to Cross Site Scripting (XSS).Packagist · kantorge/yaffa
- CVE-2026-35452WWBN AVideo has Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.phpPackagist · wwbn/avideo
- CVE-2026-35450WWBN AVideo has Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.phpPackagist · wwbn/avideo
- CVE-2026-35449WWBN AVideo has Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.phpPackagist · wwbn/avideo