Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-43885WWBN AVideo: Exposure of Sensitive Information to an Unauthorized Actor and Missing AuthorizationPackagist · wwbn/avideo
- CVE-2026-43884WWBN AVideo: SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()Packagist · wwbn/avideo
- CVE-2026-43883WWBN AVideo: IDOR in PayPalYPT agreementCancel.json.php Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription AgreementsPackagist · wwbn/avideo
- CVE-2026-43882WWBN AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event SpoofingPackagist · wwbn/avideo
- CVE-2026-43881WWBN AVideo: Unauthenticated User Enumeration in `objects/users.json.php` via `isCompany` Parameter Flips `$ignoreAdmin = true` and Defeats Admin-Only Listing GuardPackagist · wwbn/avideo
- CVE-2026-43880WWBN AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Allows Phishing from Site's Legitimate From AddressPackagist · wwbn/avideo
- CVE-2026-43879WWBN AVideo: Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect BypassPackagist · wwbn/avideo
- CVE-2026-43878WWBN AVideo: Reflected XSS in plugin/Meet/iframe.php via Unescaped `user`/`pass` Parameters Reflected into JavaScript String LiteralPackagist · wwbn/avideo
- CVE-2026-43877WWBN AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Any Logged-in User's Profile Photo with Arbitrary BytesPackagist · wwbn/avideo
- CVE-2026-43876WWBN AVideo: HTML Injection in notifySubscribers.json.php Enables Platform-Branded Phishing Emails to Channel SubscribersPackagist · wwbn/avideo
- CVE-2026-43875WWBN AVideo: Password Hash Leaked in MobileManager OAuth Redirect URL Enables Account TakeoverPackagist · wwbn/avideo
- CVE-2026-43873WWBN AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone ServerPackagist · wwbn/avideo
- CVE-2026-43874WWBN AVideo: Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay BypassPackagist · wwbn/avideo
- CVE-2026-42882oxyno-zeta/s3-proxy: Security Issues in Resource Path MatchingGo · github.com/oxyno-zeta/s3-proxy · fixed in 0.0.0-20260424211602-1320e4abd46a
- CVE-2026-42874Microdot: HTTP response splitting in Response.set_cookie()PyPI · microdot · fixed in 2.6.1
- CVE-2026-2614Arbitrary File Read via Prompt Tag Source Validation Bypass in mlflow/mlflowPyPI · mlflow · fixed in 3.10.0
- CVE-2026-42565@workos/authkit-session: Open Redirect via state-derived redirect targetnpm · @workos/authkit-session · fixed in 0.5.1
- CVE-2026-42876External Secrets Operator: Privilege escalation with secret overwritingGo · github.com/external-secrets/external-secrets/apis · fixed in 2.4.1
- CVE-2026-42875External Secrets Operator: Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStoreGo · github.com/external-secrets/external-secrets · fixed in 2.4.0
- CVE-2026-8319aiwaves-cn agents cheshire_cat_core stray_cat.py recall_relevant_memories_to_working_memory resource consumptionPyPI · ai-agents
- CVE-2026-42864FireFighter: Unauthenticated SSRF in Raid jira_bot endpoint allows IAM credential theftPyPI · firefighter-incident · fixed in 0.0.54
- CVE-2026-45224Crabbox < 0.9.0 Path Traversal via Islo Provider Workspace ResolutionGo · github.com/openclaw/crabbox · fixed in 0.9.0
- CVE-2026-43969Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1Hex · cowlib · fixed in 2.21.0
- CVE-2026-45222Summarize Insecure Daemon Configuration File Permissionsnpm · @steipete/summarize · fixed in 0.15.0
- CVE-2026-43995Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)npm · flowise, flowise-components · fixed in 3.1.0
- CVE-2026-42856Network-AI: Missing authentication on MCP HTTP endpoint allows unauthenticated privileged tool callsnpm · network-ai · fixed in 5.1.3
- CVE-2026-42860Open edx Enterprise Service: SSRF via SAML metadata URL in sync_provider_data endpointPyPI · edx-enterprise · fixed in 7.0.5
- CVE-2026-45006OpenClaw < 2026.4.23 - Unsafe Config Mutation via Gateway Tool Denylist Bypassnpm · openclaw · fixed in 2026.4.23
- CVE-2026-45005OpenClaw < 2026.4.23 - Webhook Route Secret Cache Not Invalidated After Rotationnpm · openclaw · fixed in 2026.4.23
- CVE-2026-45004OpenClaw < 2026.4.23 - Arbitrary Code Execution via setup-api.js in Current Working Directorynpm · openclaw · fixed in 2026.4.23