Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-7206dubydu sqlite-mcp entry.py extract_to_json sql injectionPyPI · sqlite-mcp
- CVE-2026-38651Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0.Go · github.com/gravitl/netmaker · fixed in 1.5.0
- CVE-2026-40977When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file's location can corruMaven · org.springframework.boot:spring-boot-cassandra · fixed in 4.0.6, 3.5.14
- CVE-2026-40976In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints.Maven · org.springframework.boot:spring-boot · fixed in 4.0.6
- CVE-2026-40975Values produced by ${random.value} are not suitable for use as secrets.Maven · org.springframework.boot:spring-boot-cassandra · fixed in 4.0.6, 3.5.14
- CVE-2026-40974Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra.Maven · org.springframework.boot:spring-boot-cassandra · fixed in 4.0.6, 3.5.14
- CVE-2026-40973A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`.Maven · org.springframework.boot:spring-boot · fixed in 4.0.6, 3.5.14
- CVE-2026-41372OpenClaw < 2026.4.2 - Loopback Protection Bypass via Trailing-Dot Localhost in CDP Discoverynpm · openclaw · fixed in 2026.4.2
- CVE-2026-41371OpenClaw < 2026.3.28 - Privilege Escalation via chat.send Reset Commandnpm · openclaw · fixed in 2026.3.28
- CVE-2026-41370OpenClaw < 2026.3.31 - Path Traversal via Inbound Channel Attachment Path in ACP Dispatchnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41369OpenClaw < 2026.3.31 - Insufficient Environment Variable Sanitization in Host Executionnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41368OpenClaw < 2026.3.28 - Environment Variable Disclosure via jq $ENV Filter Bypassnpm · openclaw · fixed in 2026.3.28
- CVE-2026-41367OpenClaw 2026.2.14 < 2026.3.28 - Policy Enforcement Bypass in Discord Component Interactionsnpm · openclaw · fixed in 2026.3.28
- CVE-2026-41366OpenClaw < 2026.3.31 - Arbitrary Host File Read via appendLocalMediaParentRoots Self-Whitelistingnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41365OpenClaw < 2026.3.31 - Sender Allowlist Bypass via Graph API Thread Historynpm · openclaw · fixed in 2026.3.31
- CVE-2026-41364OpenClaw < 2026.3.31 - Arbitrary File Write via Symlink Following in SSH Sandbox Tar Uploadnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41363OpenClaw 2026.2.6 < 2026.3.28 - Arbitrary File Read via Feishu upload_image Parameternpm · openclaw · fixed in 2026.3.28
- CVE-2026-41362OpenClaw 2026.2.19 through 2026.3.30 - Webhook Replay Dedupe Cache Event Suppression via Shared Authenticationnpm · openclaw · fixed in 2026.3.31
- CVE-2026-40972An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote seMaven · org.springframework.boot:spring-boot-devtools · fixed in 4.0.6, 3.5.14
- CVE-2026-40971When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to thMaven · org.springframework.boot:spring-boot-rabbitmq · fixed in 4.0.6, 3.5.14
- CVE-2026-7159douinc mkdocs-mcp-plugin server.py list_documents path traversalPyPI · mkdocs-mcp-plugin
- CVE-2026-7158dmitryglhf mcp-url-downloader server.py _validate_url_safe server-side request forgeryPyPI · mcp-url-downloader
- CVE-2026-5362Pimcore Platform v12.3.3 - Stored XSS in Document Editable Embed renderingPackagist · pimcore/pimcore
- CVE-2026-5394Pimcore Platform v12.3.3 - SQL Injection in DataObject composite index handlingPackagist · pimcore/pimcore · fixed in 12.3.7, 11.5.17, 2026.1.3
- CVE-2026-40970When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting Maven · org.springframework.boot:spring-boot-elasticsearch · fixed in 4.0.6
- CVE-2026-7150dh1011 auto-favicon MCP Tool server.py generate_favicon_from_url server-side request forgeryPyPI · auto-favicon
- CVE-2026-7149dexhunter kaggle-mcp server.py prepare_kaggle_dataset path traversalPyPI · kaggle-mcp
- CVE-2026-7142Wooey API Endpoint scripts.py add_or_update_script improper authorizationPyPI · wooey · fixed in 0.13.3rc1
- CVE-2026-7141vLLM KV Block kv_cache_interface.py has_mamba_layers uninitialized resourcePyPI · vllm · fixed in 0.19.1
- CVE-2026-6970authd Denial of Service and Local Privilege EscalationGo · github.com/canonical/authd · fixed in 0.6.4