Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-50879An issue in the uploadPostHandler component of Andrei Marcu linx-server v2.3.8 allows attackers to cause a Denial of Service (DoS) via a craGo · github.com/andreimarcu/linx-server
- CVE-2026-50880An issue in the sendmail transport integration component of YouTransfer v1.0.6 allows attackers to execute arbitrary code via supplying a crnpm · youtransfer
- CVE-2026-50884Incorrect access control in statping-ng v0.93.0 allows attackers to escalate privileges to Administrator and access sensitive components.Go · github.com/statping-ng/statping-ng
- CVE-2026-50886Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via aPackagist · grumpydictator/firefly-iii
- CVE-2026-50887A Server-Side Request Forgery (SSRF) in the automatic short URL title resolution component of shlink v5.0.1 allows attackers to scan internaPackagist · shlinkio/shlink
- CVE-2026-50888An authenticated Server-Side Request Forgery (SSRF) in the custom scraper subsystem component of Benjamin Jonard Koillection v1.8.0 allows aPackagist · koillection/koillection · fixed in 1.8.4
- CVE-2026-50891Incorrect access control in the /admin/api/config component of Filestash v0.4.0 allows attackers to escalate privileges via sending a crafteGo · github.com/mickael-kerjean/filestash
- CVE-2026-54421In OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can returnPyPI · ironic · fixed in 29.0.6, 32.0.2, 35.0.2 and more
- CVE-2026-11624The Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DNGo · github.com/googleapis/genai-toolbox, github.com/googleapis/mcp-toolbox · fixed in 0.25.0
- CVE-2026-11769Operator - Namespaced User Path TraversalGo · github.com/grafana/grafana-operator, github.com/grafana/grafana-operator/v3 +2 · fixed in 5.24.0
- CVE-2026-53839OpenClaw < 2026.5.7 - Hostname Prefix Matching Bypass in Trusted Retry Endpoint Validationnpm · openclaw · fixed in 2026.5.7
- CVE-2026-53838OpenClaw < 2026.5.27 - Node Pairing State Mutation via Reconnectionnpm · openclaw · fixed in 2026.5.27
- CVE-2026-53837OpenClaw < 2026.5.6 - Missing Channel Type Validation in Mattermost Event Handlersnpm · openclaw · fixed in 2026.5.6
- CVE-2026-53836OpenClaw < 2026.5.12 - Allowlist Bypass via PowerShell Encoded-Command Aliasesnpm · openclaw · fixed in 2026.5.12
- CVE-2026-53835OpenClaw < 2026.5.6 - Config-Write Enforcement Bypass in Feishu Dynamic-Agent Bindingsnpm · openclaw · fixed in 2026.5.6
- CVE-2026-53834OpenClaw < 2026.4.27 - Authorization Bypass in QQBot Pre-dispatch Slash Commandsnpm · openclaw · fixed in 2026.4.27
- CVE-2026-53833QQBot for OpenClaw < 2026.4.29 - Authorization Bypass via QQBot Streaming Commandnpm · openclaw · fixed in 2026.4.29
- CVE-2026-53832OpenClaw < 2026.5.18 - Identity Header Forgery via Trusted-Proxy Configurationnpm · openclaw · fixed in 2026.5.18
- CVE-2026-53831OpenClaw < 2026.5.18 - Arbitrary File Read via Shell Expansion in system.run Safe-bin Allowlistnpm · openclaw · fixed in 2026.5.18
- CVE-2026-53830OpenClaw < 2026.4.22 - Webhook Secret Revocation Bypass via secrets.reloadnpm · openclaw · fixed in 2026.4.22
- CVE-2026-53829OpenClaw < 2026.5.18 - Command Truncation in Exec Approval Displaynpm · openclaw · fixed in 2026.5.18
- CVE-2026-53828OpenClaw < 2026.5.6 - Native Command Authorization Bypass via Owner-Command Enforcementnpm · openclaw · fixed in 2026.5.6
- CVE-2026-53827OpenClaw < 2026.5.2 - Credential Exposure via Model-Supplied Loopback URLs in message.action Forwardingnpm · openclaw · fixed in 2026.5.2
- CVE-2026-53826OpenClaw < 2026.4.26 - Information Disclosure via Sandboxed Session Spawnnpm · openclaw · fixed in 2026.4.26
- CVE-2026-53825OpenClaw < 2026.4.7 - Arbitrary Local File Read via memory-wiki Ingest with operator.write Scopenpm · openclaw · fixed in 2026.5.12
- CVE-2026-53824Mattermost plugin for OpenClaw < 2026.4.24 - Slash Token Revocation Lag via Monitor Refresh Delaynpm · openclaw · fixed in 2026.4.24
- CVE-2026-53823OpenClaw < 2026.5.3 - Privilege Escalation via Mutable Slack Display Names in allowFromnpm · openclaw · fixed in 2026.5.3
- CVE-2026-53822OpenClaw < 2026.5.18 - Command Argument Modification via Shell Wrapper Between Approval and Executionnpm · openclaw · fixed in 2026.5.18
- CVE-2026-53821OpenClaw < 2026.5.18 - Scope Elevation in trusted-proxy Control UI WebSocketnpm · openclaw · fixed in 2026.5.18
- CVE-2026-53820OpenClaw < 2026.5.12 - Exec Denylist Bypass in Bundle MCP Loopback Session Spawnnpm · openclaw · fixed in 2026.5.12