Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-28399NocoDB: SQL Injection via DATEADD Formulanpm · nocodb · fixed in 0.301.3
- CVE-2026-28398NocoDB: Stored Cross-Site Scripting via Comments and Rich Text Cellsnpm · nocodb · fixed in 0.301.3
- CVE-2026-28397NocoDB: Stored Cross-Site Scripting via Commentsnpm · nocodb · fixed in 0.301.3
- CVE-2026-28396NocoDB: Refresh Tokens Not Revoked on Password Resetnpm · nocodb · fixed in 0.301.3
- CVE-2026-28361NocoDB: Missing Ownership Validation in MCP Token Operationsnpm · nocodb · fixed in 0.301.3
- CVE-2026-28360NocoDB: Plaintext Storage of Shared View Passwordsnpm · nocodb · fixed in 0.301.3
- CVE-2026-28359NocoDB: Stored Cross-Site Scripting via Rich Text Fieldnpm · nocodb · fixed in 0.301.3
- CVE-2026-28358NocoDB: User Enumeration via Password Reset Endpointnpm · nocodb · fixed in 0.301.3
- CVE-2026-28357NocoDB: Stored Cross-Site Scripting via Formula Cellnpm · nocodb · fixed in 0.301.3
- CVE-2026-2880@fastify/middie has an improper path normalization vulnerabilitynpm · @fastify/middie · fixed in 9.2.0
- CVE-2026-2293NestJS 11.1.13 - Lack of data validation allowing authentication/authorization bypassnpm · @nestjs/platform-fastify · fixed in 11.1.14
- CVE-2026-3304Multer vulnerable to Denial of Service via incomplete cleanupnpm · multer · fixed in 2.1.0
- CVE-2026-2359Multer vulnerable to Denial of Service via resource exhaustionnpm · multer · fixed in 2.1.0
- CVE-2026-28363In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations (such as --compresnpm · openclaw · fixed in 2026.2.23
- CVE-2026-26861CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-Site Scripting (XSS) via window.postMessage.npm · clevertap-web-sdk · fixed in 1.15.3
- CVE-2026-26862CleverTap Web SDK version 1.15.2 and earlier is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage in the Visual Builnpm · clevertap-web-sdk · fixed in 1.15.3
- CVE-2026-27638ActualBudget missing authorization in sync endpoints allows cross-user budget file access in multi-user modenpm · @actual-app/sync-server · fixed in 26.2.1
- CVE-2026-27970Angular i18n vulnerable to Cross-Site Scripting (XSS)npm · @angular/core · fixed in 21.2.0, 21.1.6, 20.3.17 and more
- CVE-2026-27959Koa has Host Header Injection via `ctx.hostname`npm · koa · fixed in 3.1.2, 2.16.4
- CVE-2026-27942fast-xml-parser has stack overflow in XMLBuilder with preserveOrdernpm · fast-xml-parser · fixed in 5.3.8, 4.5.4
- CVE-2026-27904minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressionsnpm · minimatch · fixed in 10.2.3, 9.0.7, 8.0.6 and more
- CVE-2026-27903minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segmentsnpm · minimatch · fixed in 10.2.3, 9.0.7, 8.0.6 and more
- CVE-2026-27902Svelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markersnpm · svelte · fixed in 5.53.5
- CVE-2026-27901Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`npm · svelte · fixed in 5.53.5
- CVE-2026-27829Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSizenpm · @astrojs/node · fixed in 9.5.4
- CVE-2026-27837Dottie vulnerable to prototype pollution bypass via non-first path segments in set() and transform()npm · dottie · fixed in 2.0.7
- CVE-2026-27818TerriaJS-Server has a domain validation bypass vulnerability in its proxy allowlistnpm · terriajs-server · fixed in 4.0.3
- CVE-2026-27804Parse Server: Account takeover via JWT algorithm confusion in Google auth adapternpm · parse-server · fixed in 9.3.1-alpha.4, 8.6.3
- CVE-2026-27498n8n has Arbitrary Command Execution via File Write and Git Operationsnpm · n8n · fixed in 1.123.8, 2.2.0
- CVE-2026-27578n8n Vulnerable to Stored XSS via Various Nodesnpm · n8n · fixed in 1.123.22, 2.9.3, 2.10.1