Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-77366obsidian-tc tokens can access arbitrary configured vaultsnpm · obsidian-tc · fixed in 1.3.1
- CVE-2026-77364obsidian-tc fail-open default ACL exposes Obsidian control-directory secretsnpm · obsidian-tc · fixed in 1.3.1
- CVE-2026-77363obsidian-tc Streamable HTTP transport permits cross-origin loopback vault accessnpm · obsidian-tc · fixed in 1.3.1
- CVE-2026-109346better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /devicenpm · better-auth · fixed in 1.7.0-rc.3
- CVE-2026-109345DOMPurify before 3.4.16 XSS via IN_PLACE Returned Rawtext Rootnpm · dompurify · fixed in 3.4.16
- CVE-2026-109344DOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE afterSanitize Hooksnpm · dompurify · fixed in 3.4.16
- CVE-2026-108261TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragmentnpm · @tinacms/app, tinacms · fixed in 2.5.14, 3.14.0
- CVE-2026-108260@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSSnpm · @tinacms/web-components · fixed in 0.2.1
- CVE-2026-108259Tina: Code injection via unescaped Git branch name in generated client sourcenpm · @tinacms/cli · fixed in 3.0.0
- CVE-2026-107724fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgerynpm · fast-jwt · fixed in 6.3.0
- CVE-2026-107723fast-jwt : Silent claim-validator bypass when JWT payload is a JSON arraynpm · fast-jwt · fixed in 6.3.0
- CVE-2026-107722fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusionnpm · fast-jwt · fixed in 6.3.0
- CVE-2026-107721fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)npm · fast-jwt · fixed in 6.3.0
- CVE-2026-107720fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly setnpm · fast-jwt · fixed in 6.3.1
- CVE-2026-107719fast-jwt: Verifier cache accepts expired JWTs without iat.npm · fast-jwt · fixed in 6.3.4
- CVE-2026-107718AdonisJS: Unencoded route parameters can produce open redirectsnpm · @adonisjs/http-server · fixed in 9.3.0, 8.2.3
- CVE-2026-107392music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of CVE-2026-32256)npm · music-metadata · fixed in 11.15.0
- CVE-2026-107391music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on masternpm · music-metadata · fixed in 11.16.0
- CVE-2026-107389music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abortnpm · music-metadata · fixed in 11.16.0
- CVE-2026-107388music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoSnpm · music-metadata · fixed in 11.16.0
- CVE-2026-107387music-metadata: Uncontrolled memory allocation in APEv2 parsernpm · music-metadata · fixed in 11.16.0
- CVE-2026-107385MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPESnpm · mariadb · fixed in 3.2.5, 3.3.4, 3.4.7 and more
- CVE-2026-107384MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)npm · mariadb · fixed in 3.2.5, 3.3.4, 3.4.7 and more
- CVE-2026-107383MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parametersnpm · mariadb · fixed in 3.2.5, 3.3.4, 3.4.7 and more
- CVE-2026-107382MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLSnpm · mariadb · fixed in 3.5.4
- CVE-2026-107375JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssortnpm · generator-jhipster · fixed in 9.4.0
- CVE-2026-107303JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blobnpm · generator-jhipster, react-jhipster · fixed in 9.4.0, 1.1.0
- CVE-2026-107302msgpack5: Truncated map32 headers throw an unexpected errornpm · msgpack5 · fixed in 6.1.0
- CVE-2026-107301msgpack5: Partial options disable prototype protectionnpm · msgpack5 · fixed in 6.1.0
- CVE-2026-107300msgpack5: Many buffered values can exhaust the streaming decoder stacknpm · msgpack5 · fixed in 6.1.0