Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-40213OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints.PyPI · openstack-cyborg · fixed in 16.0.1
- CVE-2026-40214In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer.PyPI · openstack-cyborg · fixed in 16.0.1
- CVE-2026-41484OpenTelemetry.Exporter.OneCollector vulnerable to denial of service via unbounded HTTP error response bodyNuGet · opentelemetry.exporter.onecollector · fixed in 1.15.1
- CVE-2026-41483Unbounded HTTP response body read in OpenTelemetry.Resources.AzureNuGet · opentelemetry.resources.azure · fixed in 1.15.1-beta.1
- CVE-2026-41310OpenTelemetry .NET Zipkin exporter has unbounded remote endpoint cache leading to memory growthNuGet · opentelemetry.exporter.zipkin · fixed in 1.15.3
- CVE-2026-41417Netty vulnerable to HTTP request smuggling and RTSP request injection via DefaultHttpRequest.setUri()Maven · io.netty:netty-codec-http · fixed in 4.1.133.Final, 4.2.13.Final
- CVE-2026-40296PhpSpreadsheet vulnerable to XSS in HTML writer via custom number format codesPackagist · phpoffice/phpspreadsheet · fixed in 5.7.0, 3.10.5, 2.4.5 and more
- CVE-2026-40281Gotenberg vulnerable to argument injection via newlines in ExifTool metadata valuesGo · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8 · fixed in 8.31.0
- CVE-2026-40251Incus out-of-bounds panic in snapshot metadata handling allows denial of serviceGo · github.com/lxc/incus, github.com/lxc/incus/v6 +2 · fixed in 7.0.0
- CVE-2026-40243Incus OVN TLS verification accepts peer-supplied roots and permits endpoint impersonationGo · github.com/lxc/incus, github.com/lxc/incus/v6 +2 · fixed in 7.0.0
- CVE-2026-40197Incus nil-pointer dereference in custom volume import allows denial of serviceGo · github.com/lxc/incus, github.com/lxc/incus/v6 +2 · fixed in 7.0.0
- CVE-2026-40195Incus nil-pointer dereference in storage bucket import allows denial of serviceGo · github.com/lxc/incus, github.com/lxc/incus/v6 +2 · fixed in 7.0.0
- CVE-2026-44118OpenClaw < 2026.4.22 - Owner Context Spoofing via Bearer Token Headernpm · openclaw · fixed in 2026.4.22
- CVE-2026-44117OpenClaw < 2026.4.20 - Server-Side Request Forgery in QQBot Direct Media Uploadnpm · openclaw · fixed in 2026.4.20
- CVE-2026-44116OpenClaw < 2026.4.22 - Server-Side Request Forgery in Zalo Photo URL Validationnpm · openclaw · fixed in 2026.4.22
- CVE-2026-44115OpenClaw < 2026.4.22 - Shell Expansion Bypass in Unquoted Heredocs via Exec Allowlistnpm · openclaw · fixed in 2026.4.22
- CVE-2026-44114OpenClaw < 2026.4.20 - Environment Variable Namespace Collision via Workspace dotenvnpm · openclaw · fixed in 2026.4.20
- CVE-2026-44113OpenClaw < 2026.4.22 - Time-of-Check/Time-of-Use Race Condition in OpenShell FS Bridgenpm · openclaw · fixed in 2026.4.22
- CVE-2026-44112OpenClaw < 2026.4.22 - Symlink Swap Race Condition in OpenShell FS Bridge Writesnpm · openclaw · fixed in 2026.4.22
- CVE-2026-44111OpenClaw < 2026.4.15 - Arbitrary Markdown File Read via QMD memory_getnpm · openclaw · fixed in 2026.4.15
- CVE-2026-44109OpenClaw < 2026.4.15 - Authentication Bypass in Feishu Webhook and Card-Action Validationnpm · openclaw · fixed in 2026.4.15
- CVE-2026-43585OpenClaw < 2026.4.15 - Bearer Token Validation Bypass via Stale SecretRef Resolutionnpm · openclaw · fixed in 2026.4.15
- CVE-2026-43584OpenClaw < 2026.4.10 - Insufficient Environment Variable Denylist in Exec Policynpm · openclaw · fixed in 2026.4.10
- CVE-2026-43583OpenClaw 2026.4.10 < 2026.4.14 - Loss of Group Tool-Policy Context in Delivery Queue Recoverynpm · openclaw · fixed in 2026.4.14
- CVE-2026-43582OpenClaw < 2026.4.10 - DNS Rebinding SSRF via Hostname Validation Bypassnpm · openclaw · fixed in 2026.4.10
- CVE-2026-43581OpenClaw < 2026.4.10 - Chrome DevTools Protocol Exposure via Overly Broad CDP Relay Bindingnpm · openclaw · fixed in 2026.4.10
- CVE-2026-43580OpenClaw < 2026.4.10 - Incomplete Navigation Guard Coverage in Browser Interactionsnpm · openclaw · fixed in 2026.4.10
- CVE-2026-43579OpenClaw < 2026.4.10 - Insufficient Access Control in Nostr Profile Mutation Routesnpm · openclaw · fixed in 2026.4.10
- CVE-2026-43578OpenClaw 2026.3.31 < 2026.4.10 - Privilege Escalation via Missed Async Exec Completion Events in Heartbeat Owner Downgradenpm · openclaw · fixed in 2026.4.10
- CVE-2026-43577OpenClaw < 2026.4.9 - Arbitrary File Read via Browser Interaction Routesnpm · openclaw · fixed in 2026.4.9