Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-31019In the Website module of Dolibarr ERP & CRM 22.0.4 and below, the application uses blacklist-based filtering to restrict dangerous PHP functPackagist · dolibarr/dolibarr
- CVE-2026-35570OpenClaude has Sandbox Bypass via Early-Exit Logic Flaw that Allows Path Traversalnpm · @gitlawb/openclaude · fixed in 0.5.1
- CVE-2026-35588Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config ValuesPyPI · glances · fixed in 4.5.4
- CVE-2026-35587Glances IP Plugin has SSRF via public_api that leads to credential leakagePyPI · glances · fixed in 4.5.4
- CVE-2026-34839Glances Vulnerable to Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORSPyPI · glances · fixed in 4.5.4
- CVE-2026-41331OpenClaw < 2026.3.31 - Resource Consumption via Unauthorized Telegram Audio Preflight Transcriptionnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41330OpenClaw < 2026.3.31 - Environment Variable Override via Host Exec Policynpm · openclaw · fixed in 2026.3.31
- CVE-2026-41329OpenClaw < 2026.3.31 - Sandbox Bypass via Heartbeat Context Inheritance and senderIsOwner Escalationnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41303OpenClaw < 2026.3.28 - Authorization Bypass in Discord Text Approval Commandsnpm · openclaw · fixed in 2026.3.28
- CVE-2026-41302OpenClaw < 2026.3.31 - Server-Side Request Forgery via Unguarded fetch() in Marketplace Plugin Downloadnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41301OpenClaw 2026.3.22 < 2026.3.31 - Forged Nostr DM Pairing State Creation via Signature Verification Bypassnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41300OpenClaw < 2026.3.31 - Preservation of Attacker-Discovered Endpoints in Remote Onboardingnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41299OpenClaw < 2026.3.28 - Client Identity Spoofing in chat.send Gateway Provenance Guardnpm · openclaw · fixed in 2026.3.28
- CVE-2026-41298OpenClaw < 2026.4.2 - Authorization Bypass in Session Termination Endpointnpm · openclaw · fixed in 2026.4.2
- CVE-2026-41297OpenClaw < 2026.3.31 - Server-Side Request Forgery via Marketplace Plugin Download Redirectnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41296OpenClaw < 2026.3.31 - Sandbox Escape via TOCTOU Race in Remote FS Bridge readFilenpm · openclaw · fixed in 2026.3.31
- CVE-2026-41295OpenClaw < 2026.4.2 - Untrusted Workspace Channel Shadow Code Execution during Built-in Channel Setupnpm · openclaw · fixed in 2026.4.2
- CVE-2026-41294OpenClaw < 2026.3.28 - Environment Variable Injection via CWD .env Filenpm · openclaw · fixed in 2026.3.28
- CVE-2026-40045OpenClaw < 2026.4.2 - Cleartext Credential Transmission via Unencrypted WebSocket Gateway Endpointsnpm · openclaw · fixed in 2026.4.2
- CVE-2026-33626LMDeploy Vulnerable to Server-Side Request Forgery (SSRF) via Vision-Language Image LoadingPyPI · lmdeploy
- CVE-2026-34403Nginx-UI vulnerable to Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpointsGo · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260316053337-1a9cd29a3082
- CVE-2026-33031Nginx-UI: Disabled users retain full API access through previously issued bearer tokensGo · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20260314152518-7b66578adb47
- CVE-2026-32613Spinnaker vulnerable to RCE via expression parsing due to unrestricted context handlingMaven · io.spinnaker.echo:echo-pipelinetriggers · fixed in 2026.0.1, 2025.4.2, 2025.3.2
- CVE-2026-32604Spinnaker vulnerable to RCE when using gitrepo artifact types due to improper sanitization of user input on branch and pathsMaven · io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo · fixed in 2026.0.1
- CVE-2026-6550Key commitment policy bypass via shared key cache in AWS Encryption SDK for PythonPyPI · aws-encryption-sdk · fixed in 3.3.1, 4.0.5
- CVE-2026-41389OpenClaw 2026.4.7 < 2026.4.15 - Arbitrary File Read via Unvalidated Tool-Result Media Pathsnpm · openclaw · fixed in 2026.4.15
- CVE-2026-28684python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallbackPyPI · python-dotenv · fixed in 1.2.2
- CVE-2026-40488OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code ExecutionPackagist · openmage/magento-lts · fixed in 20.17.0
- CVE-2026-40098OpenMage LTS imports cross-user wishlist item via shared wishlist code, leading to private option disclosure and file-disclosure variantPackagist · openmage/magento-lts · fixed in 20.17.0
- CVE-2026-25525OpenMage LTS has Path Traversal Filter Bypass in Dataflow ModulePackagist · openmage/magento-lts · fixed in 20.17.0