CVE-2026-53846 OpenClaw < 2026.4.29 - Arbitrary Package Manager Execution via Workspace .env npm_execpath

OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows workspace .env files to override the npmexecpath configuration used for bundled runtime dependency installation. Attackers with workspace access can execute unintended local package-manager...

GHSA-V5FF-9Q35-Q26F Langflow: Unauthenticated RCE in Shareable Playgrounds

Summary The "Shareable Playground" or "Public Flows" in code contains a critical RCE vulnerability. Simply sharing a flow exposes the deployment to RCE risk by authenticated users. Tested on commit 2d67402b1dbaefcbce85a244d4a6cd5e4bda1cfe Details Shareable Playground feature works by enabling the...

CVE-2026-12003 CPython >3.11 Insecure Input Validation resulting in privilege escalation

To allow builds of Python to be run from an in-tree layout rather than an installed file layout, the VPATH variable is defined at build time and used to locate certain landmarks - specifically, Modules/setup.local. When this landmark is found relative to VPATH relative to the executable, Python...

CVE-2026-12003 CPython >3.11 Insecure Input Validation resulting in privilege escalation

To allow builds of Python to be run from an in-tree layout rather than an installed file layout, the VPATH variable is defined at build time and used to locate certain landmarks - specifically, Modules/setup.local. When this landmark is found relative to VPATH relative to the executable, Python...

CVE-2026-12003 CPython >3.11 Insecure Input Validation resulting in privilege escalation

To allow builds of Python to be run from an in-tree layout rather than an installed file layout, the VPATH variable is defined at build time and used to locate certain landmarks - specifically, Modules/setup.local. When this landmark is found relative to VPATH relative to the executable, Python...

CVE-2026-12003

To allow builds of Python to be run from an in-tree layout rather than an installed file layout, the VPATH variable is defined at build time and used to locate certain landmarks - specifically, Modules/setup.local. When this landmark is found relative to VPATH relative to the executable, Python...

EUVD-2026-37125

To allow builds of Python to be run from an in-tree layout rather than an installed file layout, the VPATH variable is defined at build time and used to locate certain landmarks - specifically, Modules/setup.local. When this landmark is found relative to VPATH relative to the executable, Python...

Cross-site Scripting (XSS)

Overview astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the addAttribute function, which interpolates unescaped object keys as HTML attribute names when spreadi...

@a1st/aix (>=0.0.3, <=0.6.0), @a1st/aix-core (>=0.2.0, <=0.6.0) +19 more potentially affected by CVE-2026-54298 via astro (>=6.0.0-beta.1, <=6.4.4)

astro NPM version =6.0.0-beta.1, =0.0.3, =0.2.0, =1.11.1, =2.7.0, =0.3.0, =1.4.1, =0.19.0, =0.19.0, =1.10.0, =1.0.0, =1.1.0 and more Source cves: CVE-2026-54298 Source advisory: OSV:GHSA-JRPJ-WCV7-9FH9...

@a1st/aix (>=0.0.3, <=0.6.0), @a1st/aix-core (>=0.2.0, <=0.6.0) +19 more potentially affected by CVE-2026-54299 via astro (>=6.0.0-beta.1, <=6.4.4)

astro NPM version =6.0.0-beta.1, =0.0.3, =0.2.0, =1.11.1, =2.7.0, =0.3.0, =1.4.1, =0.19.0, =0.19.0, =1.10.0, =1.0.0, =1.1.0 and more Source cves: CVE-2026-54299 Source advisory: SNYK:JS-ASTRO-17356189...

@a1st/aix (>=0.0.3, <=0.6.0), @a1st/aix-core (>=0.2.0, <=0.6.0) +19 more potentially affected by CVE-2026-54299 via astro (>=6.0.0-beta.1, <=6.4.4)

astro NPM version =6.0.0-beta.1, =0.0.3, =0.2.0, =1.11.1, =2.7.0, =0.3.0, =1.4.1, =0.19.0, =0.19.0, =1.10.0, =1.0.0, =1.1.0 and more Source cves: CVE-2026-54299 Source advisory: OSV:GHSA-2PVR-WF23-7PC7...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the pbjs static code generation. An attacker can execute arbitrary code by providing crafted schema names that are incorporated into generated JavaScript output, which is then executed or imported by the...

GHSA-537C-GMF6-5CCF Vulnerable OpenSSL included in cryptography wheels

pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in wheels prior to cryptograph 48.01 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://openssl-library.org/news/secadv/20260609.txt. If yo...

Vulnerable OpenSSL included in cryptography wheels

pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in wheels prior to cryptograph 48.01 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://openssl-library.org/news/secadv/20260609.txt. If yo...

Malicious code in yunxin-overmind-comment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57551a10d99024d1d12c7f2e349e6557613ed3a5e036bf45d71129d501fbbabc On npm install, the package's scripts.postinstall runs src/postinstall.js, which spawns a detached Node child that collects the installer's hostname,...

@ablehi/automation-app-build (>=0.1.0, <=0.2.2), @ablehi/automation-app-cli (>=0.1.0, <=0.2.2) +236 more potentially affected by CVE-2026-53632 via vite (>=8.0.0, <=8.0.14)

vite NPM version =8.0.0, =0.1.0, =0.1.0, =0.94.0, =0.1.0, =1.1.2, =1.2.0, =3.0.1-alpha.0, =1.0.0, =0.1.0, =0.1.0, =3.3.0, =3.4.0 and more Source cves: CVE-2026-53632 Source advisory: OSV:GHSA-V6WH-96G9-6WX3...

@142vip/vuepress (0.0.1-alpha.19), @agregio-solutions/design-system (>=1.89.2, <=1.100.0) +250 more potentially affected by CVE-2026-53632 via vite (>=7.0.0, <=7.3.3)

vite NPM version =7.0.0, =1.89.2, =20.1.0-next.3, =20.1.0-next.3, =0.1.0, =0.0.4, =0.2.9, =0.79.1, =1.0.0, =1.11.1, =1.0.0-beta.23, =2.1.2-alpha.0, =1.0.0-alpha.0, =2.23.0, =2.37.0 and more Source cves: CVE-2026-53632 Source advisory: OSV:GHSA-V6WH-96G9-6WX3...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @aicblock/cli (>=1.0.0, <=1.0.1) +239 more potentially affected by CVE-2026-53632 via vite (>=6.0.0, <=6.4.2)

vite NPM version =6.0.0, =0.0.1, =1.0.0, =1.0.0, =0.2.0, =4.25.19-patch.2, =19.0.0-beta.0, =19.0.0-beta.0, =19.1.0-next.0, =19.1.0-next.0, =6.0.0-beta.1, =6.0.0 and more Source cves: CVE-2026-53632 Source advisory: OSV:GHSA-V6WH-96G9-6WX3...

@ablehi/automation-app-build (>=0.1.0, <=0.2.2), @ablehi/automation-app-cli (>=0.1.0, <=0.2.2) +236 more potentially affected by CVE-2026-53571 via vite (>=8.0.0, <=8.0.14)

vite NPM version =8.0.0, =0.1.0, =0.1.0, =0.94.0, =0.1.0, =1.1.2, =1.2.0, =3.0.1-alpha.0, =1.0.0, =0.1.0, =0.1.0, =3.3.0, =3.4.0 and more Source cves: CVE-2026-53571 Source advisory: SNYK:JS-VITE-17353904...

@142vip/vuepress (0.0.1-alpha.19), @agregio-solutions/design-system (>=1.89.2, <=1.100.0) +250 more potentially affected by CVE-2026-53571 via vite (>=7.0.0, <=7.3.3)

vite NPM version =7.0.0, =1.89.2, =20.1.0-next.3, =20.1.0-next.3, =0.1.0, =0.0.4, =0.2.9, =0.79.1, =1.0.0, =1.11.1, =1.0.0-beta.23, =2.1.2-alpha.0, =1.0.0-alpha.0, =2.23.0, =2.37.0 and more Source cves: CVE-2026-53571 Source advisory: OSV:GHSA-FX2H-PF6J-XCFF...