Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-125115Novu: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter conditionnpm · @novu/application-generic · fixed in 3.17.0
- SZB-5ab74d9eedEthersphere's bee-js and Swarm Desktop releases reported to carry wallet-stealing malwarenpm · @ethersphere/bee-js
- CVE-2026-92683Incomplete evaluation of multi-condition JWT where filter in @authentication in @neo4j/graphqlnpm · @neo4j/graphql · fixed in 7.6.7
- CVE-2026-123566Devalue before 5.9.3 CPU Amplification Denial of Service via unevalnpm · devalue · fixed in 5.9.3
- CVE-2026-123562Devalue 5.8.0 before 5.9.3 Denial of Service via stringifyAsync Unhandled Rejectionnpm · devalue · fixed in 5.9.3
- CVE-2026-106128Prototype Pollution in Progress Software Kendo UI for Vuenpm · @progress/kendo-vue-common · fixed in 10.0.0
- CVE-2026-106127Prototype Pollution in Progress Software KendoReactnpm · @progress/kendo-react-common · fixed in 16.1.0
- CVE-2026-106144Prototype Pollution in Progress Software Kendo UI for Angularnpm · @progress/kendo-angular-common, @progress/kendo-angular-scheduler · fixed in 25.1.0
- CVE-2026-106143Cross-Site Scripting in Progress Software Kendo UI for Vuenpm · @progress/kendo-vue-editor · fixed in 10.1.0
- CVE-2026-106142Cross-Site Scripting in Progress Software KendoReactnpm · @progress/kendo-react-editor · fixed in 16.2.0
- CVE-2026-106141Cross-Site Scripting in Progress Software Kendo UI for Angularnpm · @progress/kendo-angular-editor · fixed in 25.3.0
- CVE-2026-106136Cross-Site Scripting in Progress Software KendoReactnpm · @progress/kendo-react-conversational-ui · fixed in 16.2.0
- CVE-2026-106134Cross-Site Scripting in Progress Software KendoReactnpm · @progress/kendo-react-layout · fixed in 16.2.0
- CVE-2026-106135Cross-Site Scripting in Progress Software Kendo UI for Angularnpm · @progress/kendo-angular-conversational-ui · fixed in 25.3.0
- CVE-2026-111768Model Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validationnpm · @modelcontextprotocol/sdk, @modelcontextprotocol/server · fixed in 1.32.0, 2.3.0
- CVE-2026-111769Model Context Protocol TypeScript SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom…npm · @modelcontextprotocol/client, @modelcontextprotocol/sdk · fixed in 2.3.0, 1.32.0
- CVE-2026-111771Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another servicenpm · @modelcontextprotocol/express, @modelcontextprotocol/sdk +2 · fixed in 2.0.2, 1.32.0, 2.3.0 and more
- CVE-2026-114604GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segmentsnpm · @graphql-tools/utils · fixed in 12.0.2
- CVE-2026-111753Angular: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)npm · @angular/common · fixed in 21.0.3, 20.3.34
- CVE-2026-46350dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASSnpm · dcmjs · fixed in 0.52.0
- CVE-2026-76892tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP processnpm · @tsparticles/mcp-server · fixed in 4.3.1
- CVE-2026-76893tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clientsnpm · @tsparticles/mcp-server · fixed in 4.3.2
- CVE-2026-63655tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoSnpm · @tsparticles/mcp-server · fixed in 4.3.1
- CVE-2026-122131Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 Prototype Replacement via proto Language Keynpm · @hapi/joi, joi · fixed in 17.13.6, 18.2.5
- CVE-2026-97705Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parsernpm · moleculer · fixed in 0.15.2, 0.14.36
- CVE-2026-114456Missing origin validation for the externalbrowser authenticator callback in multiple Snowflake client driversnpm · snowflake-sdk · fixed in 3.4.0
- CVE-2026-111751Angular: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)npm · @angular/router · fixed in 22.2.1, 21.2.25
- CVE-2026-111752Angular: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)npm · @angular/router · fixed in 22.2.1, 21.2.25, 20.3.33
- CVE-2026-76894CKAN MCP Server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)npm · @aborruso/ckan-mcp-server · fixed in 0.4.112
- CVE-2026-88968Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspacenpm · @anthropic-ai/claude-code · fixed in 2.1.251