CVE-2026-35179

creationtimestamp| type| source ---|---|--- 2026-04-01 18:48:36+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-x9w5-xccw-5h9w...

Arbitrary Code Injection

Overview org.webjars.npm:lodash is a modern JavaScript utility library delivering modularity, performance, & extras. Affected versions of this package are vulnerable to Arbitrary Code Injection due the improper validation of options.imports key names in .template. An attacker can execute arbitrar...

GHSA-VR79-8M62-WH98

creationtimestamp| type| source ---|---|--- 2026-03-31 19:20:27+00:00| published-proof-of-concept| Telegram/pGlKXNBirRT0gxqFC1bVLs6pojbUfu72MTdyyvCxHD2SpM...

CVE-2026-34729

creationtimestamp| type| source ---|---|--- 2026-03-31 17:23:49+00:00| published-proof-of-concept| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-cv2g-8cj8-vgc7 2026-03-31 17:23:49+00:00| published-proof-of-concept|...

CVE-2026-34974

creationtimestamp| type| source ---|---|--- 2026-03-31 17:23:15+00:00| published-proof-of-concept| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-5crx-pfhq-4hgg...

GHSA-37CH-88JC-XWX2 vulnerabilities

Vulnerabilities for packages: json-server, kubeflow-centraldashboard, kubeflow-pipelines, kubeflow-katib, argo-workflows, sqlpad...

CVE-2026-34715

creationtimestamp| type| source ---|---|--- 2026-03-30 19:31:23+00:00| published-proof-of-concept| https://github.com/vshakitskiy/ewe/security/advisories/GHSA-x2w3-23jr-hrpf 2026-03-30 19:31:23+00:00| published-proof-of-concept|...

CVE-2026-34523

creationtimestamp| type| source ---|---|--- 2026-03-30 17:31:58+00:00| published-proof-of-concept| https://github.com/SillyTavern/SillyTavern/security/advisories/GHSA-525j-2hrj-m8fp 2026-03-30 17:31:58+00:00| published-proof-of-concept|...

Malicious Package

Overview eslint-validator is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

GHSA-2J22-PR5W-6GQ8 vulnerabilities

Vulnerabilities for packages: ruby3.4-rails...

Incorrect Authorization

Overview @openclaw/feishu is an OpenClaw Feishu/Lark channel plugin community maintained by @m1heng Affected versions of this package are vulnerable to Incorrect Authorization via the callback handling process. An attacker can gain unauthorized access to callback functionality by sending speciall...

CVE-2026-33029

creationtimestamp| type| source ---|---|--- 2026-03-28 03:20:34+00:00| published-proof-of-concept| https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-cp8r-8jvw-v3qg...

GHSA-RWCR-RPCC-3G9M

creationtimestamp| type| source ---|---|--- 2026-03-27 21:23:14+00:00| published-proof-of-concept| Telegram/B1-lnNSHplGL4tzlck3EB0WXwjfJllp4cXItiyc0oKB0vU...

CVE-2026-34396

creationtimestamp| type| source ---|---|--- 2026-03-27 18:49:12+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-v4h7-3x43-qqw4...

CVE-2026-34360

creationtimestamp| type| source ---|---|--- 2026-03-27 13:33:36+00:00| published-proof-of-concept| https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-3ww8-jw56-9f5h...

GHSA-H6C8-CWW8-35HF vulnerabilities

Vulnerabilities for packages: grafana...

CVE-2026-28786

creationtimestamp| type| source ---|---|--- 2026-03-26 23:29:07+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-vvxm-vxmr-624h...

Incorrect Authorization

Overview @openclaw/tlon is an OpenClaw Tlon/Urbit channel plugin Affected versions of this package are vulnerable to Incorrect Authorization via the cite expansion process before authorization is complete. An attacker can access or manipulate content prior to proper authorization by triggering ci...

Replay Attack

Overview @openclaw/voice-call is an OpenClaw voice-call plugin Affected versions of this package are vulnerable to Replay Attack due to improper derivation of the replay key in the webhook-security.ts process. An attacker can bypass replay protection and submit multiple authenticated requests by...

CVE-2026-33766

creationtimestamp| type| source ---|---|--- 2026-03-24 13:00:13+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-f359-r3pv-2phf 2026-03-24 13:00:13+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-f359-r3pv-2phf...