Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-53841OpenClaw < 2026.5.12 - Cross-Site Scripting via Unsafe Markdown Links in Exported Session HTMLnpm · openclaw · fixed in 2026.5.12
- CVE-2026-53840OpenClaw < 2026.5.12 - Custom Header Leakage via MCP Streamable HTTP Cross-Origin Redirectsnpm · openclaw · fixed in 2026.5.12
- CVE-2026-48775LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loadingPyPI · langgraph-checkpoint · fixed in 4.1.1
- CVE-2026-42089yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmationnpm · yeoman-environment · fixed in 6.0.1
- CVE-2025-71261Harvester's SUSE Virtualization Registration Client Vulnerable to MITM and DOSGo · github.com/harvester/harvester · fixed in 1.8.0
- CVE-2026-12398Galaxy_ng: shell injection in legacy role import via unsanitized git ref namesPyPI · galaxy-ng
- CVE-2026-47684Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIPnpm · @sync-in/server · fixed in 2.3.0
- CVE-2026-46448In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data.PyPI · nova · fixed in 31.3.1, 32.2.1, 33.0.2
- CVE-2026-48853Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpcHex · grpc · fixed in 1.0.0
- CVE-2026-48599Authorization bypass via path binding override in elixir-grpc/grpc HTTP transcodingHex · grpc · fixed in 1.0.0
- CVE-2026-48854Unbounded request body accumulation causes memory exhaustion in elixir-grpc/grpcHex · grpc · fixed in 1.0.0
- CVE-2026-48157Slim has Reflected XSS in the HtmlErrorRendererPackagist · slim/slim · fixed in 4.15.2
- CVE-2026-48017DbGate: Remote Code Execution via functionName injection in loadReader endpointnpm · dbgate-api · fixed in 7.1.9
- CVE-2026-48714i18next-http-middleware missingKeyHandler does not reject keys whose segments contain prototype-polluting namesnpm · i18next-http-middleware · fixed in 3.9.7
- CVE-2026-48713i18next-fs-backend: Prototype pollution via crafted missing-key stringnpm · i18next-fs-backend · fixed in 2.6.6
- CVE-2026-48709OliveTin: ValidateArgumentType API Endpoint Missing Authentication Allows Action and Argument EnumerationGo · github.com/olivetin/olivetin · fixed in 0.0.0-20260521230847-a3865704c854
- CVE-2026-48708OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command ContaminationGo · github.com/olivetin/olivetin · fixed in 0.0.0-20260521225117-d74da9314005
- CVE-2026-47261Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restrictioncrates.io · wasmtime-wasi · fixed in 44.0.2, 36.0.10, 24.0.9 and more
- CVE-2026-41708Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerabilityMaven · org.springframework.cloud:spring-cloud-sleuth-instrumentation
- CVE-2026-47835Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector StoresMaven · org.springframework.ai:spring-ai-elasticsearch-store, org.springframework.ai:spring-ai-gemfire-store +1 · fixed in 1.0.9, 1.1.8
- CVE-2026-9595webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxiesnpm · webpack-dev-server · fixed in 5.2.5
- CVE-2026-5038multer vulnerable to Denial of Service via incomplete cleanup of aborted uploadsnpm · multer · fixed in 2.2.0, 3.0.0-alpha.2
- CVE-2026-5079multer vulnerable to Denial of Service via deeply nested field namesnpm · multer · fixed in 2.2.0, 3.0.0-alpha.2
- CVE-2026-12210universal-tool-calling-protocol python-utcp utcp-gql/utcp-websocket server-side request forgeryPyPI · utcp-gql, utcp-websocket · fixed in 1.1.1
- CVE-2026-12208jsonata-js jsonata Function Binding Frame System jsonata.js createFrame prototype pollutionnpm · jsonata · fixed in 1.8.8, 2.2.1
- CVE-2026-12202Intelliants Subrion CMS Blocks Endpoint cross site scriptingPackagist · intelliants/subrion
- CVE-2026-12198Microweber API Endpoint thumbnail_img userfiles_path path traversalPackagist · microweber/microweber
- CVE-2026-30120remotion-dev remotion v4.0.409 was discovered to contain a remote code execution (RCE) vulnerability.npm · remotion · fixed in 4.0.410
- CVE-2026-30121remotion-dev remotion v4.0.409 was discovered to contain an arbitrary file write vulnerability.npm · remotion · fixed in 4.0.410
- CVE-2026-39006An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component.Maven · org.snmp4j:snmp4j-agent