Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-34084PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::loadPackagist · phpoffice/phpspreadsheet · fixed in 5.6.0, 3.10.4, 2.4.4 and more
- CVE-2026-33489CoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparisonGo · github.com/coredns/coredns · fixed in 1.14.3
- CVE-2026-32936CoreDNS DoH GET path missing size validation causes CPU and memory amplificationGo · github.com/coredns/coredns · fixed in 1.14.3
- CVE-2026-32934CoreDNS DNS-over-QUIC unbounded goroutine growth leads to denial of serviceGo · github.com/coredns/coredns · fixed in 1.14.3
- CVE-2026-33190CoreDNS TSIG authentication bypass on encrypted DNS transportsGo · github.com/coredns/coredns · fixed in 1.14.3
- CVE-2026-32699FacturaScripts unauthorized modification of immutable nick field via EditUser controllerPackagist · facturascripts/facturascripts
- CVE-2026-27960OpenCTI privilege escalation and unauthenticated access via default admin accountPyPI · pycti · fixed in 6.9.13
- CVE-2026-7847chatchat-space Langchain-Chatchat Uploaded File openai_routes.py _get_file_id random valuesPyPI · langchain-chatchat
- CVE-2026-7846chatchat-space Langchain-Chatchat OpenAI-Compatible File Upload API openai_routes.py files toctouPyPI · langchain-chatchat
- CVE-2026-7845chatchat-space Langchain-Chatchat Vision Chat Paste Image dialogue.py PIL.Image.tobytes weak hashPyPI · langchain-chatchat
- CVE-2025-61669jupyter_server next parameter open redirect can redirect users to external domainsPyPI · jupyter-server · fixed in 2.18.0
- CVE-2026-35192Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUESTPyPI · django · fixed in 6.0.5, 5.2.14
- CVE-2026-6907Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddlewarePyPI · django · fixed in 5.2.14, 6.0.5
- CVE-2026-5766Potential denial-of-service vulnerability in ASGI requests via file upload limit bypassPyPI · django · fixed in 6.0.5, 5.2.14
- CVE-2026-7412In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination URMaven · org.eclipse.basyx:basyx.sdk · fixed in 2.0.0-milestone-10
- CVE-2026-7411In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unauMaven · org.eclipse.basyx:basyx.sdk · fixed in 2.0.0-milestone-10
- CVE-2026-30246github.com/gofiber/fiber/v3 cache middleware can mix responses across query parametersGo · github.com/gofiber/fiber/v3 · fixed in 3.2.0
- CVE-2026-43574OpenClaw < 2026.4.12 - Improper Authorization via Empty Approver Listsnpm · openclaw · fixed in 2026.4.12
- CVE-2026-43573OpenClaw < 2026.4.10 - SSRF Policy Bypass in Existing-Session Browser Interaction Routesnpm · openclaw · fixed in 2026.4.10
- CVE-2026-43572OpenClaw 2026.4.10 < 2026.4.14 - Missing Sender Authorization in Microsoft Teams SSO Invoke Handlernpm · openclaw · fixed in 2026.4.14
- CVE-2026-43571OpenClaw < 2026.4.10 - Untrusted Workspace Plugin Shadow Resolution in Channel Setupnpm · openclaw · fixed in 2026.4.10
- CVE-2026-43570OpenClaw 2026.3.22 < 2026.4.5 - Symlink Traversal in Remote Marketplace Repository Path Handlingnpm · openclaw · fixed in 2026.4.5
- CVE-2026-43569OpenClaw < 2026.4.9 - Untrusted Provider Plugin Auto-enablement via Workspace Provider Authnpm · openclaw · fixed in 2026.4.9
- CVE-2026-43568OpenClaw 2026.4.5 through 2026.4.9 - Privilege Escalation via Memory Dreaming Configuration in /dreaming Endpointnpm · openclaw · fixed in 2026.4.10
- CVE-2026-43567OpenClaw < 2026.4.10 - Path Traversal in screen_record outPath Parameternpm · openclaw · fixed in 2026.4.10
- CVE-2026-43566OpenClaw 2026.4.7 < 2026.4.14 - Privilege Escalation via Untrusted Webhook Wake Eventsnpm · openclaw · fixed in 2026.4.14
- CVE-2026-43535OpenClaw < 2026.4.14 - Authorization Context Reuse in Collect-Mode Queue Batchesnpm · openclaw · fixed in 2026.4.14
- CVE-2026-43534OpenClaw < 2026.4.10 - Unsanitized External Input in Agent Hook Eventsnpm · openclaw · fixed in 2026.4.10
- CVE-2026-43533OpenClaw < 2026.4.10 - Arbitrary Local File Read via QQBot Media Tagsnpm · openclaw · fixed in 2026.4.10
- CVE-2026-43532OpenClaw 2026.4.7 < 2026.4.10 - Sandbox Media Normalization Bypass via Discord Event Cover Imagenpm · openclaw · fixed in 2026.4.10