Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-35647OpenClaw < 2026.3.25 - Direct Message Policy Bypass via Verification Noticesnpm · openclaw
- CVE-2026-35643OpenClaw < 2026.3.22 - Arbitrary Code Execution via Unvalidated WebView JavascriptInterfacenpm · openclaw · fixed in 2026.3.22
- CVE-2026-35641OpenClaw < 2026.3.24 - Arbitrary Code Execution via .npmrc in Local Plugin/Hook Installationnpm · openclaw · fixed in 2026.3.24
- CVE-2026-35621OpenClaw < 2026.3.24 - Privilege Escalation via chat.send to Allowlist Persistencenpm · openclaw · fixed in 2026.3.24
- CVE-2026-35620OpenClaw < 2026.3.24 - Missing Authorization in /send and /allowlist Chat Commandsnpm · openclaw · fixed in 2026.3.24
- CVE-2026-35619OpenClaw < 2026.3.24 - Authorization Bypass via HTTP /v1/models Endpointnpm · openclaw · fixed in 2026.3.24
- CVE-2026-35596Vikunja has Broken Access Control on Label Read via SQL Operator Precedence BugGo · code.vikunja.io/api · fixed in 2.3.0
- CVE-2026-35595Vikunja Affected by Privilege Escalation via Project ReparentingGo · code.vikunja.io/api · fixed in 2.3.0
- CVE-2026-35594Vikunja Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgradeGo · code.vikunja.io/api · fixed in 2.3.0
- CVE-2026-34727Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login PathGo · code.vikunja.io/api · fixed in 2.3.0
- CVE-2026-40021Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden charactersNuGet · log4net · fixed in 3.3.0
- CVE-2026-34481Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayoutMaven · org.apache.logging.log4j:log4j-layout-template-json · fixed in 2.25.4
- CVE-2026-34480Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden charactersMaven · org.apache.logging.log4j:log4j-core · fixed in 2.25.4
- CVE-2026-34479Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden charactersMaven · org.apache.logging.log4j:log4j-core · fixed in 2.25.4
- CVE-2026-34478Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibilityMaven · org.apache.logging.log4j:log4j-core · fixed in 2.25.4
- CVE-2026-34477Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypassMaven · org.apache.logging.log4j:log4j-core · fixed in 2.25.4
- CVE-2026-40217LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.PyPI · litellm · fixed in 1.83.10
- CVE-2026-5412Juju CloudSpec API could leak senstive informationGo · github.com/juju/juju · fixed in 0.0.0-20260408003526-d395054dc2c3
- CVE-2026-5774Juju API Server Denial of Service and Authentication Replay via Unsynchronized Token MapGo · github.com/juju/juju · fixed in 0.0.0-20260408003526-d395054dc2c3
- CVE-2026-39304Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOMMaven · org.apache.activemq:activemq-all, org.apache.activemq:activemq-broker +2 · fixed in 5.19.4, 6.2.4
- CVE-2026-22750SSL bundle configuration silently bypassed in Spring Cloud GatewayMaven · org.springframework.cloud:spring-cloud-gateway · fixed in 4.2.1
- CVE-2026-1115Stored XSS in parisneo/lollmsPyPI · lollms · fixed in 2.2.0
- CVE-2026-6011OpenClaw assertPublicHostname web-fetch.ts server-side request forgerynpm · openclaw · fixed in 2026.1.29
- CVE-2026-33551An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0.PyPI · keystone · fixed in 26.1.1
- CVE-2026-5986Zod jsVideoUrlParser util.js getTime redosnpm · js-video-url-parser
- CVE-2026-40154PraisonAI Affected by Untrusted Remote Template Code ExecutionPyPI · praisonai · fixed in 4.5.128
- CVE-2026-40151PraisonAI Affected by Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOSPyPI · praisonai · fixed in 4.5.128
- CVE-2026-40153PraisonAIAgents Affected by Environment Variable Secret Exfiltration via os.path.expandvars() Bypassing shell=False in Shell ToolPyPI · praisonaiagents · fixed in 1.5.128
- CVE-2026-35646OpenClaw < 2026.3.25 - Pre-Authentication Rate-Limit Bypass in Webhook Token Validationnpm · openclaw · fixed in 2026.3.28
- CVE-2026-35645OpenClaw < 2026.3.25 - Privilege Escalation via Synthetic operator.admin in deleteSessionnpm · openclaw · fixed in 2026.3.28