Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-40103Vikunja's Scoped API tokens with projects.background permission can delete project backgroundsGo · code.vikunja.io/api · fixed in 2.3.0
- CVE-2026-35602Vikunja has a File Size Limit Bypass via Vikunja ImportGo · code.vikunja.io/api · fixed in 2.3.0
- CVE-2026-35601Vikunja has an iCalendar Property Injection via CRLF in CalDAV Task OutputGo · code.vikunja.io/api · fixed in 2.3.0
- CVE-2026-35600Vikunja has HTML Injection via Task Titles in Overdue Email NotificationsGo · code.vikunja.io/api · fixed in 2.3.0
- CVE-2026-35599Vikunja has an Algorithmic Complexity DoS in Repeating Task HandlerGo · code.vikunja.io/api · fixed in 2.3.0
- CVE-2026-35598Vikunja has Missing Authorization on CalDAV Task ReadGo · code.vikunja.io/api · fixed in 2.3.0
- CVE-2026-35670OpenClaw < 2026.3.22 - Webhook Reply Rebinding via Username Resolution in Synology Chatnpm · openclaw · fixed in 2026.3.22
- CVE-2026-35669OpenClaw < 2026.3.25 - Privilege Escalation via Gateway Plugin HTTP Authentication Scopenpm · openclaw
- CVE-2026-35668OpenClaw < 2026.3.24 - Sandbox Media Root Bypass via Unnormalized mediaUrl and fileUrl Parametersnpm · openclaw · fixed in 2026.3.24
- CVE-2026-35667OpenClaw < 2026.3.24 - Improper Process Termination via Unpatched killProcessTree in shell-utils.tsnpm · openclaw · fixed in 2026.3.24
- CVE-2026-35666OpenClaw < 2026.3.22 - Allowlist Bypass via Unregistered Time Dispatch Wrappernpm · openclaw · fixed in 2026.3.22
- CVE-2026-35665OpenClaw < 2026.3.24 - Denial of Service via Feishu Webhook Pre-Auth Body Parsingnpm · openclaw · fixed in 2026.3.24
- CVE-2026-35664OpenClaw < 2026.3.25 - DM Pairing Bypass via Legacy Card Callbacksnpm · openclaw · fixed in 2026.3.28
- CVE-2026-35663OpenClaw < 2026.3.25 - Privilege Escalation via Backend Reconnect Scope Self-Claimnpm · openclaw
- CVE-2026-35662OpenClaw < 2026.3.22 - Missing controlScope Enforcement in Send Actionnpm · openclaw · fixed in 2026.3.22
- CVE-2026-35661OpenClaw < 2026.3.25 - Telegram DM-Scoped Inline Button Callback Authorization Bypassnpm · openclaw · fixed in 2026.3.28
- CVE-2026-35660OpenClaw < 2026.3.23 - Insufficient Access Control in Gateway Agent Session Resetnpm · openclaw · fixed in 2026.3.23
- CVE-2026-35659OpenClaw < 2026.3.22 - Unresolved Service Metadata Routing via Bonjour and DNS-SD Discoverynpm · openclaw · fixed in 2026.3.22
- CVE-2026-35658OpenClaw < 2026.3.2 - Filesystem Boundary Bypass in Image Toolnpm · openclaw · fixed in 2026.3.2
- CVE-2026-35597Vikunja Affected by TOTP Brute-Force Due to Non-Functional Account LockoutGo · code.vikunja.io/api · fixed in 2.3.0
- CVE-2026-35657OpenClaw < 2026.3.25 - Authorization Bypass in HTTP Session History Routenpm · openclaw · fixed in 2026.3.25
- CVE-2026-35656OpenClaw < 2026.3.22 - XFF Loopback Spoofing Bypass in Canvas Authentication and Rate Limiternpm · openclaw · fixed in 2026.3.22
- CVE-2026-35655OpenClaw < 2026.3.22 - Identity Spoofing via rawInput Tool in ACP Permission Resolutionnpm · openclaw · fixed in 2026.3.22
- CVE-2026-35654OpenClaw < 2026.3.25 - Authorization Bypass in Microsoft Teams Feedback Invokenpm · openclaw · fixed in 2026.3.28
- CVE-2026-35653OpenClaw < 2026.3.24 - Incorrect Authorization in POST /reset-profile via browser.requestnpm · openclaw · fixed in 2026.3.24
- CVE-2026-35652OpenClaw < 2026.3.22 - Unauthorized Action Execution via Callback Dispatchnpm · openclaw · fixed in 2026.3.22
- CVE-2026-35651OpenClaw 2026.2.13 < 2026.3.25 - ANSI Escape Sequence Injection in Approval Promptnpm · openclaw · fixed in 2026.3.28
- CVE-2026-35650OpenClaw < 2026.3.22 - Environment Variable Override Bypass via Inconsistent Sanitizationnpm · openclaw · fixed in 2026.3.22
- CVE-2026-35649OpenClaw < 2026.3.22 - Settings Reconciliation Bypass via Empty Allowlistnpm · openclaw · fixed in 2026.3.22
- CVE-2026-35648OpenClaw < 2026.3.22 - Policy Bypass via Unvalidated Queued Node Actionsnpm · openclaw · fixed in 2026.3.22