npm package vulnerabilities
The newest vulnerabilities affecting npm packages, up to 200. Subscribe by RSS.
- GHSA-W9X9-J56R-H98R@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy@eeacms/volto-chatbot
- GHSA-C33X-VCV4-VG3GCedar: JSON template is in scope missing slot-id validation allows link panic and decision divergencecedar-policy · @cedar-policy/cedar-wasm
- CVE-2026-118666GraphQL Tools: Shared legacy executor routes one subscription's results to a different callerardatan graphql-tools · @graphql-tools executor-legacy-ws +1
- CVE-2026-118665GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authenticationsardatan graphql-tools · @graphql-tools executor-legacy-ws +1
- CVE-2026-118664decode-uri-component: Denial of service via quadratic replacement of percent-encoded runsSamVerschueren decode-uri-component · decode-uri-component
- CVE-2026-118663@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static pathshonojs node-server · @hono/node-server
- CVE-2026-118662Vite: `server.fs.deny` bypassed with queriesvitejs vite · vite
- CVE-2026-118661Happy DOM: Cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookiescapricorn86 happy-dom · happy-dom
- CVE-2026-118660Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTMLcapricorn86 happy-dom · happy-dom
- GHSA-4MFG-R38W-W8FGmcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6mcp-sanitizer
- GHSA-7W82-6F9J-V9JPmcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Pathsmcp-sanitizer
- CVE-2026-118258i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query stringi18next-http-backend
- CVE-2026-118257Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messagesintlify vue-i18n · vue-i18n +5
- CVE-2026-118256Vue I18n: `escapeParameter` does not escape named values when the same call also passes a listintlify vue-i18n · vue-i18n +4
- CVE-2026-118255Highcharts Grid: javascript: URL in credits.href runs script on clickhighcharts · @highcharts dashboards +3
- CVE-2026-118254Highcharts Grid: pagination language options are parsed as HTMLhighcharts · @highcharts grid-lite +3
- CVE-2026-118253Highcharts Dashboards: fullscreen labels are parsed as HTMLhighcharts · @highcharts dashboards +1
- CVE-2026-118252Highcharts Dashboards: sidebar component labels are parsed as HTMLhighcharts · @highcharts dashboards +1
- CVE-2026-118251Highcharts: javascript: URL in credits.href runs script on clickhighcharts
- CVE-2026-118250Highcharts: dotted series.keys paths write to Object.prototypehighcharts
- CVE-2026-118249Highcharts: series column construction writes to Object.prototypehighcharts
- CVE-2026-118247Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.highcharts · @highcharts dashboards +3
- CVE-2026-118246Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributeshighcharts
- CVE-2026-118245Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespacehighcharts · @highcharts dashboards +1
- CVE-2026-118244Highcharts Core: AST `DOMParser` fallback assigns unsanitized markup to `innerHTML` during printhighcharts
- CVE-2026-118243Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype`highcharts · @highcharts/dashboards
- CVE-2026-118242Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`highcharts · @highcharts grid-lite +3
- CVE-2026-116797Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`highcharts · @highcharts grid-pro +3
- CVE-2026-116796Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported chartshighcharts
- CVE-2026-116795RE2JS: Quadratic-time denial of service in re2js lookbehind matchingle0pard re2js · re2js
- CVE-2026-59179OpenHop: Path Traversal in Flow ID File Operationsnaorsabag openhop · @openhop/server
- CVE-2026-55369Waline login accepts a non-string email as a match-all MongoDB querywalinejs waline · @waline/vercel
- CVE-2026-59158Nuxt Ollama: public runtime configuration discloses the configured cloud API keythoda-dev nuxt-ollama · nuxt-ollama
- CVE-2026-116693dd-trace: ReDOS in URL query string obfuscationDataDog dd-trace-js · dd-trace
- CVE-2026-116688CKEditor: Cross-site scripting (XSS) in the engine packageckeditor5 · @ckeditor/ckeditor5-engine
- CVE-2026-116687CKEditor: Cross-site scripting (XSS) in the engine packageckeditor5 · @ckeditor/ckeditor5-engine
- GHSA-F897-62HF-6GXQMCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length@modelcontextprotocol/sdk · @modelcontextprotocol/server +2
- CVE-2026-116675TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serializationtinymce · tinymce/tinymce
- CVE-2026-116674systeminformation: Prototype pollution in `networkStats()` via the interface namesebhildebrandt systeminformation · systeminformation
- CVE-2026-116673systeminformation: Path traversal in Linux networkStats() allows symlink-based file disclosure outside /sys/class/netsebhildebrandt systeminformation · systeminformation
- CVE-2026-116804DOMPurify from 3.4.4 before 3.4.17 SAFE_FOR_TEMPLATES Bypass via Shadow Root Contentcure53 DOMPurify · dompurify
- CVE-2026-116803DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtreescure53 DOMPurify · dompurify
- CVE-2026-116802DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Modecure53 DOMPurify · dompurify
- CVE-2026-116584Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node lengthlxsmnsyc seroval · seroval
- CVE-2026-116583Seroval: Code injection through a typed array's own constructor propertylxsmnsyc seroval · seroval
- CVE-2026-116582Seroval: Script injection through RegExp sources in serialized outputlxsmnsyc seroval · seroval
- CVE-2026-116581Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS)lxsmnsyc seroval · seroval
- CVE-2026-116580Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type checklxsmnsyc seroval · seroval
- CVE-2026-116576systeminformation: Windows command injection in services() through Unicode quotation markssebhildebrandt systeminformation · systeminformation
- CVE-2026-116575Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)mem0ai mem0 · mem0ai
- CVE-2026-115923Backstage catalog rules can be bypassed for URL locations using encoded path segmentsbackstage · @backstage/plugin-catalog-backend
- GHSA-H4FR-CMH5-QR62Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project rootfallow · @fallow-cli/fallow-node +3
- GHSA-F2HQ-32VH-53CCpostal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded wordspostal-mime
- GHSA-8C8M-P3M8-CJG8Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipientnodemailer
- GHSA-M943-M63M-W62WNodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipientnodemailer
- GHSA-85X2-Q946-CP5HNodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not namenodemailer
- CVE-2026-115897Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function bodyyahoo serialize-javascript · serialize-javascript
- CVE-2026-115895Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code executioncapricorn86 happy-dom · happy-dom
- CVE-2026-115887graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of servicegraphql-hive graphql-scalars · graphql-scalars
- CVE-2026-115570Electron: Mitigation for compromised eMudhra intermediate certificateselectron
- CVE-2026-115569Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project rootfallow-rs fallow · @fallow-cli fallow-node +6
- CVE-2026-58497Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requestsolo-dot-io Uni-CLI · @zenalexa/unicli
- CVE-2026-115478obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changesThe-40-Thieves obsidian-tc · obsidian-tc
- CVE-2026-115477obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTPThe-40-Thieves obsidian-tc · obsidian-tc
- CVE-2026-115754serialize-javascript 7.0.1 before 7.1.3 XSS via unescaped </script in function bodyyahoo serialize-javascript · serialize-javascript
- CVE-2026-115730i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrli18next-http-backend
- CVE-2026-115728@hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsinghapijs @hapi/content · @hapi/content
- CVE-2026-106763An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitize@justice8096/sagemath-mcp-server
- CVE-2026-106764An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.@rog0x/mcp-git-tools
- CVE-2026-115419Unintended disclosure of data element to wrong session in Strands Agents SDK A2A ServerAWS strands-agents · AWS strands-agents/sdk +2
- CVE-2026-114607better-auth: OAuth state can be used as a Magic Link to sign in as another userbetter-auth
- CVE-2026-94482Next.js: Denial of Service in App Router using Server Actionsvercel next.js · next
- CVE-2026-113872multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardownmulter
- CVE-2026-114144toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()BinaryMuse toml-node · toml
- CVE-2026-114143toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()BinaryMuse toml-node · toml
- CVE-2026-114142toml-node: Prototype pollution: parsing a TOML document can write to Object.prototypeBinaryMuse toml-node · toml
- CVE-2026-114141toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()BinaryMuse toml-node · toml
- CVE-2026-114139Sentry-Javascript: Middleware Bypass when using Tunnel routegetsentry sentry-javascript · @sentry/nextjs
- CVE-2026-114133Nuxt server islands render `useHeadSafe` input without sanitisationnuxt
- CVE-2026-114132Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitivenuxt · @nuxt/nitro-server
- CVE-2026-114131Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routesnuxt
- CVE-2026-114130Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disablednuxt
- CVE-2026-114129stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of serviceuhop stream-json · stream-json
- CVE-2026-114128Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX renderingwithastro astro · astro
- CVE-2026-114127Astro: Arbitrary CSS injection in Astro View Transitionswithastro astro · astro
- CVE-2026-114126Storybook dev server: devices on the same network can obtain the WebSocket token and write code into story filesstorybookjs storybook · storybook +5
- CVE-2026-114125Storybook: Missing origin validation in Storybook preview allows code injection from malicious websitesstorybookjs storybook · storybook +5
- CVE-2026-114124Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometryelectron
- CVE-2026-114122Electron: Frame subscription trusts GPU-supplied frame geometryelectron
- CVE-2026-114121Electron: openExternal permission requests can be attributed to the wrong originelectron
- CVE-2026-113800Electron: HID and USB permission checks can be attributed to the wrong originelectron
- CVE-2026-113798Electron: Pointer lock permission requests can be attributed to the wrong frameelectron
- CVE-2026-113797Electron: Extension tabs.query returns tab URLs and titles without the tabs permissionelectron
- CVE-2026-113796Electron: SameSite cookie restrictions are not applied to windows opened from linkselectron
- CVE-2026-114113Sharp before 0.35.0 Multiple Vulnerabilities via Bundled libvips Image Decoderslovell sharp · sharp
- CVE-2026-114112Sharp before 0.35.4 RCE via bundled libheif AVIF decodinglovell sharp · sharp
- CVE-2026-114111Sharp before 0.35.5 RCE via librsvg Dependency Memory Vulnerabilitylovell sharp · sharp
- CVE-2026-114104adm-zip before 0.6.1 Duplicate ZIP Entry Name Validation Bypasscthackers adm-zip · adm-zip
- CVE-2026-114103adm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync()cthackers adm-zip · adm-zip
- CVE-2026-114102adm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error Eventcthackers adm-zip · adm-zip
- CVE-2026-114088Trigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IOtriggerdotdev trigger.dev · trigger.dev
- CVE-2026-114087Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secretstriggerdotdev trigger.dev · trigger.dev
- CVE-2026-114086Trigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpointtriggerdotdev trigger.dev · trigger.dev
- CVE-2026-114081Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Nametriggerdotdev trigger.dev · trigger.dev
- CVE-2026-114079Trigger.dev before 4.5.6 Cross-Environment Deployment Cancel via Cancel Endpointtriggerdotdev trigger.dev · trigger.dev
- CVE-2026-114076Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URLtriggerdotdev trigger.dev · trigger.dev
- CVE-2026-114073Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logstriggerdotdev trigger.dev · trigger.dev
- CVE-2026-114061SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pagessveltejs kit · @sveltejs/kit
- CVE-2026-114060SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actionssveltejs kit · @sveltejs/kit
- CVE-2026-111758markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)markdown-it
- CVE-2026-111767MCP TypeScript SDK: Experimental tasks were not tied to the session that created themmodelcontextprotocol typescript-sdk · @modelcontextprotocol…
- CVE-2026-111756follow-redirects array-form headers bypass cross-origin credential strippingfollow-redirects
- CVE-2026-113711ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-exportapostrophecms apostrophe · @apostrophecms import-export +2
- CVE-2026-113710ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessingapostrophecms apostrophe · apostrophe
- CVE-2026-113671ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRFapostrophecms apostrophe · @apostrophecms ai-helper +1
- CVE-2026-113669ApostropheCMS: Cross-domain session token in URL confers session takeoverapostrophecms apostrophe · @apostrophecms passport-bridge +2
- CVE-2026-113667ApostropheCMS: CAPTCHA response token not URL-encodedapostrophecms apostrophe · @apostrophecms form +5
- CVE-2026-113668ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)apostrophecms apostrophe · apostrophe
- CVE-2026-113666ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of serviceapostrophecms apostrophe · @apostrophecms db-connect +2
- CVE-2026-113665ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpointsapostrophecms apostrophe · apostrophe
- CVE-2026-113664ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring testapostrophecms apostrophe · @apostrophecms import-export +1
- CVE-2026-113662ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified documentapostrophecms apostrophe · @apostrophecms import-export +1
- CVE-2026-113661ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLsapostrophecms apostrophe · apostrophecms sanitize-html +1
- CVE-2026-113660ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiersapostrophecms apostrophe · apostrophe
- CVE-2026-113659ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated usersapostrophecms apostrophe · apostrophe
- CVE-2026-113658ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directoryapostrophecms apostrophe · apostrophe
- CVE-2026-113657ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)apostrophecms apostrophe · apostrophecms sanitize-html +1
- CVE-2026-113656ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoSapostrophecms apostrophe · @apostrophecms form +1
- CVE-2026-113649ApostropheCMS: Import API bypasses publication roles for protected contentapostrophecms apostrophe · @apostrophecms import-export +2
- CVE-2026-113655ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorizationapostrophecms apostrophe · apostrophe
- CVE-2026-113654ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content renderapostrophecms apostrophe · apostrophecms sanitize-html +1
- CVE-2026-113653ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)apostrophecms apostrophe · apostrophe
- CVE-2026-113652ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)apostrophecms apostrophe · apostrophecms uploadfs +1
- CVE-2026-113651ApostropheCMS: Path traversal in uploadfsapostrophecms apostrophe · apostrophecms uploadfs +1
- CVE-2026-113650ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)apostrophecms apostrophe · apostrophecms sanitize-html +1
- CVE-2026-113648ApostropheCMS: Missing Authentication in `cleanExport` Routeapostrophecms apostrophe · @apostrophecms import-export +1
- CVE-2026-112958ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serializationapostrophecms apostrophe · apostrophe
- CVE-2026-112957ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged usersapostrophecms apostrophe · apostrophe
- CVE-2026-112956ApostropheCMS: Archive duplicate continuation lets contributors overwrite published contentapostrophecms apostrophe · @apostrophecms mport-export +1
- CVE-2026-112955ApostropheCMS: Import archives can exhaust server storage and deny serviceapostrophecms apostrophe · @apostrophecms import-export +1
- CVE-2026-112954ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST APIapostrophecms apostrophe · apostrophe
- CVE-2026-112953ApostropheCMS: Exposure of Sensitive Information via predictable export filenamesapostrophecms apostrophe · @apostrophecms import-export +1
- CVE-2026-112952ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated userapostrophecms apostrophe · apostrophe
- CVE-2026-112951ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefixapostrophecms apostrophe · apostrophe
- CVE-2026-112950Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fixvitest-dev vitest · @vitest mocker +1
- CVE-2026-112949Vitest: Code injection via unauthenticated manual mock registrationvitest-dev vitest · @vitest mocker +1
- CVE-2026-112948Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token filevitest-dev vitest · @vitest browser +5
- CVE-2026-112947Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`vitejs vite · vitejs vite-plus +2
- CVE-2026-112946Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machinevitejs vite · vitejs vite-plus +2
- CVE-2026-112945Vite: Cross origin script execution through Vite custom middlewarevitejs vite · vitejs vite-plus +2
- CVE-2026-112944launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editorsvitejs launch-editor · vitejs vite +4
- CVE-2026-112943launch-editor: escapeCmdArgs() omits % escaping on Windowsvitejs launch-editor · vitejs vite +4
- CVE-2026-112942launch-editor: `fs.existsSync()` existence check can be bypassed on Windowsvitejs launch-editor · vitejs vite +4
- CVE-2026-110725fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix referencesfast-uri
- CVE-2026-110306fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decodingfast-uri
- CVE-2026-110180fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalizationfast-uri
- CVE-2026-110095fast-uri vulnerable to improper path equivalence in relative reference normalizationfast-uri
- CVE-2026-111766markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabledmarkdown-it
- CVE-2026-111759markdown-it: Quadratic complexity in smartquotes with unmatched closing quotesmarkdown-it
- CVE-2026-111757Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static pathshonojs hono · hono
- CVE-2026-111755follow-redirects sensitiveHeaders regex escaping can expose credential headersfollow-redirects
- CVE-2026-111997ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % charactersbeaugunderson ip-address · ip-address
- CVE-2026-109461Microsoft Authentication Library (MSAL) for Node.js Information Disclosure VulnerabilityMicrosoft Identity Client for NodeJS · @azure/msal-node
- CVE-2026-109932undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG bufferingundici
- CVE-2026-104150AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexityadonisjs http-server · @adonisjs/http-server
- CVE-2026-87018undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiationundici
- CVE-2026-109383undici vulnerable to TLS certificate validation bypass via dropped tls options in Agentundici
- CVE-2026-109829undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirectsundici
- CVE-2026-109841undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokensundici
- CVE-2026-109924undici vulnerable to Denial of Service via unbounded memory in the EventSource parserundici
- CVE-2026-109869undici vulnerable to Denial of Service via unhandled error on excessive content-encodingsundici
- CVE-2026-100409OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded pathsopennextjs-cloudflare · @opennextjs/cloudflare
- CVE-2026-102527Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routesnuxt-modules og-image · nuxt-og-image
- CVE-2026-109855undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshakeundici
- CVE-2026-110904ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 cApostropheCMS · apostrophe
- CVE-2026-110872Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsingnodemailer
- CVE-2026-110871Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Servicenodemailer
- CVE-2026-110870Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Commentsnodemailer
- CVE-2026-110869Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexesnodemailer
- CVE-2026-110864Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxybetter-auth
- CVE-2026-110862Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Linkbetter-auth
- CVE-2026-110861Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Conditionbetter-auth drizzle-adapter · better-auth kysely-adapter +3
- CVE-2026-110816qs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a stringljharb qs · qs
- CVE-2026-103975Appium: Symlink based Zip Slip in @appium/support ZIP extractionappium · @appium/support
- CVE-2026-101896Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR)angular · @angular router +1
- CVE-2026-101895Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPEangular · @angular/ platform-server +1
- CVE-2026-110634git-diff before 2.0.7 OS Command Injection via gitDiff Input Stringsdanday74 git-diff · git-diff
- CVE-2026-77361obsidian-tc symlink path mismatch bypasses read ACL restrictionsThe-40-Thieves obsidian-tc · obsidian-tc
- CVE-2026-77362obsidian-tc bridge tools expose data outside the read ACLThe-40-Thieves obsidian-tc · obsidian-tc
- CVE-2026-77366obsidian-tc tokens can access arbitrary configured vaultsThe-40-Thieves obsidian-tc · obsidian-tc
- CVE-2026-77364obsidian-tc fail-open default ACL exposes Obsidian control-directory secretsThe-40-Thieves obsidian-tc · obsidian-tc
- CVE-2026-77363obsidian-tc Streamable HTTP transport permits cross-origin loopback vault accessThe-40-Thieves obsidian-tc · obsidian-tc
- CVE-2026-109346better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /devicebetter-auth
- CVE-2026-103288Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment LikeTryGhost Ghost · ghost
- CVE-2026-94545Satori-generated SVG has improper escapingvercel satori · vercel next +1
- CVE-2026-93753deepmerge through 4.3.1 Prototype Poisoning via mergeObjectTehShrike deepmerge · deepmerge
- CVE-2026-61448Parse Server 9.0.0 Stored XSS via malformed Content-Typeparse-community parse-server · parse-server
- CVE-2026-61459MCP Server Kubernetes < 3.9.0 Argument Injection via kubectl Structured ToolsFlux159 mcp-server-kubernetes · mcp-server-kubernetes
- CVE-2023-31719FUXA <= 1.1.12 is vulnerable to SQL Injection via /api/signin.fuxa-server