Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-34774Electron: Use-after-free in offscreen child window paint callbacknpm · electron · fixed in 39.8.1, 40.7.0, 41.0.0
- CVE-2026-34773Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windowsnpm · electron · fixed in 38.8.6, 39.8.1, 40.8.1 and more
- CVE-2026-34772Electron: Use-after-free in download save dialog callbacknpm · electron · fixed in 38.8.6, 39.8.0, 40.7.0 and more
- CVE-2026-34771Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacksnpm · electron · fixed in 38.8.6, 39.8.0, 40.7.0 and more
- CVE-2026-34770Electron: Use-after-free in PowerMonitor on Windows and macOSnpm · electron · fixed in 38.8.6, 39.8.1, 40.8.0 and more
- CVE-2026-34768Electron: Unquoted executable path in app.setLoginItemSettings on Windowsnpm · electron · fixed in 38.8.6, 39.8.1, 40.8.0 and more
- CVE-2026-34767Electron: HTTP Response Header Injection in custom protocol handlers and webRequestnpm · electron · fixed in 38.8.6, 39.8.3, 40.8.3 and more
- CVE-2026-34766Electron: USB device selection not validated against filtered device listnpm · electron · fixed in 38.8.6, 39.8.0, 40.7.0 and more
- CVE-2026-34769Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreferencenpm · electron · fixed in 38.8.6, 39.8.0, 40.7.0 and more
- CVE-2026-34955PraisonAI: Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandboxPyPI · praisonai · fixed in 4.5.97
- CVE-2026-34954PraisonAI: SSRF in FileTools.download_file() via Unvalidated URLPyPI · praisonaiagents · fixed in 1.5.95
- CVE-2026-34953PraisonAI: Authentication Bypass in OAuthManager.validate_token()PyPI · praisonai · fixed in 4.5.97
- CVE-2026-34952PraisonAI: Missing Authentication in WebSocket GatewayPyPI · praisonai · fixed in 4.5.97
- CVE-2026-34939PraisonAI: ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search_tools()PyPI · praisonai · fixed in 4.5.90
- CVE-2026-34938PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_codePyPI · praisonaiagents · fixed in 1.5.90
- CVE-2026-34937PraisonAI: Shell Injection in run_python() via Unescaped $() SubstitutionPyPI · praisonaiagents · fixed in 1.5.90
- CVE-2026-34936PraisonAI: SSRF via Unvalidated api_base in passthrough() FallbackPyPI · praisonai · fixed in 4.5.90
- CVE-2026-34934PraisonAI: Second-Order SQL Injection in `get_all_user_threads`PyPI · praisonai · fixed in 4.5.90
- CVE-2026-34935PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()PyPI · praisonai · fixed in 4.5.69
- CVE-2026-34824Mesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of ServicePyPI · mesop · fixed in 1.2.5
- CVE-2026-34052LTI JupyterHub Authenticator: Unbounded Memory Growth via Nonce Storage (Denial of Service)PyPI · jupyterhub-ltiauthenticator · fixed in 1.6.3
- CVE-2026-33709JupyterHub has an Open Redirect VulnerabilityPyPI · jupyterhub · fixed in 5.4.4
- CVE-2026-33175OAuthenticator: Authentication Bypass in Auth0OAuthenticator via Unverified Email ClaimsPyPI · oauthenticator · fixed in 17.4.0
- CVE-2026-34511OpenClaw < 2026.4.2 - PKCE Verifier Exposure via OAuth State Parameternpm · openclaw · fixed in 2026.4.2
- CVE-2026-25726Cloudreve is vulnerable to Account Takeover via Weak Cryptographic Token Generation (Insecure PRNG Seeding)Go · github.com/cloudreve/cloudreve, github.com/cloudreve/cloudreve/v3 +1 · fixed in 4.0.0-20260205113604-ec9fdd33bc54
- CVE-2026-0545Missing Authentication for Critical Function in mlflow/mlflowPyPI · mlflow
- CVE-2026-35216Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Stepnpm · @budibase/server · fixed in 3.33.4
- CVE-2026-35214Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file writenpm · @budibase/server · fixed in 3.33.4
- CVE-2026-31818Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklistnpm · @budibase/backend-core · fixed in 3.33.4
- CVE-2026-25044Budibase: Command Injection in Bash Automation Stepnpm · @budibase/server · fixed in 3.33.4