Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-27577n8n: Expression Sandbox Escape Leads to RCEnpm · n8n · fixed in 1.123.22, 2.9.3, 2.10.1
- CVE-2026-27497n8n has Potential Remote Code Execution via Merge Nodenpm · n8n · fixed in 1.123.22, 2.9.3, 2.10.1
- CVE-2026-27495n8n has a Sandbox Escape in its JavaScript Task Runnernpm · n8n · fixed in 1.123.22, 2.9.3, 2.10.1
- CVE-2026-27494n8n has Arbitrary File Read via Python Code Node Sandbox Escapenpm · n8n · fixed in 1.123.22, 2.9.3, 2.10.1
- CVE-2026-27493n8n has Unauthenticated Expression Evaluation via Form Nodenpm · n8n · fixed in 1.123.22, 2.9.3, 2.10.1
- CVE-2026-27148Storybook Dev Server Vulnerable to WebSocket Hijackingnpm · storybook · fixed in 8.6.17, 9.1.19, 10.2.10
- CVE-2026-27795LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoadernpm · @langchain/community · fixed in 1.1.18
- CVE-2026-27739Angular SSR is vulnerable to SSRF and Header Injection via request handling pipelinenpm · @angular/ssr, @nguniversal/common +1 · fixed in 21.2.0-rc.1, 21.1.5, 20.3.17 and more
- CVE-2026-27738Angular SSR has an Open Redirect via X-Forwarded-Prefixnpm · @angular/ssr · fixed in 21.2.0-rc.1, 21.1.5, 20.3.17 and more
- CVE-2026-27728OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()npm · @oneuptime/common · fixed in 10.0.7
- CVE-2026-22866ENS DNSSEC Oracle Vulnerable to RSA Signature Forgery via Missing PKCS#1 v1.5 Padding Validationnpm · @ensdomains/ens-contracts
- CVE-2026-27702Budibase Vulnerable to Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud)npm · budibase · fixed in 3.30.4
- CVE-2026-27700Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfonpm · hono · fixed in 4.12.2
- CVE-2026-27699Basic FTP has Path Traversal Vulnerability in its downloadToDir() methodnpm · basic-ftp · fixed in 5.2.0
- CVE-2026-27597@enclave-vm/core is vulnerable to Sandbox Escapenpm · @enclave-vm/core · fixed in 2.11.1
- CVE-2026-27612Repostat Vulnerable to Reflected Cross-Site Scripting (XSS) via repo prop in RepoCardnpm · repostat · fixed in 1.0.1
- CVE-2026-27595Parse Dashboard has incomplete authentication on AI Agent endpointnpm · parse-dashboard · fixed in 9.0.0-alpha.8
- CVE-2026-27610Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessionsnpm · parse-dashboard · fixed in 9.0.0-alpha.8
- CVE-2026-27609Parse Dashboard Missing CSRF Protection on Agent Endpointnpm · parse-dashboard · fixed in 9.0.0-alpha.8
- CVE-2026-27608Parse Dashboard Missing Authorization on Agent Endpointnpm · parse-dashboard · fixed in 9.0.0-alpha.8
- CVE-2026-27606Rollup 4 has Arbitrary File Write via Path Traversalnpm · rollup · fixed in 2.80.0, 3.30.0, 4.59.0
- CVE-2026-27584ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpointsnpm · @actual-app/sync-server · fixed in 26.2.1
- CVE-2026-27567Payload has Server-Side Request Forgery (SSRF) in External File URL Uploadsnpm · payload · fixed in 3.75.0
- CVE-2026-27729Astro has memory exhaustion DoS due to missing request body size limit in Server Actionsnpm · @astrojs/node · fixed in 9.5.4
- CVE-2026-25545Astro has Full-Read SSRF in error rendering via Host: header injectionnpm · @astrojs/node · fixed in 9.5.4
- CVE-2025-69985FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE).npm · @frangoteam/fuxa
- CVE-2025-70058An issue pertaining to CWE-295: Improper Certificate Validation was discovered in YMFE yapi v1.12.0.npm · yapi-vendor
- CVE-2026-27492Lettermint Node.js SDK leaks email properties to unintended recipients when client instance is reusednpm · lettermint · fixed in 1.5.1
- CVE-2026-27574OneUptime: node:vm sandbox escape in probe allows any project member to achieve RCEnpm · @oneuptime/common · fixed in 10.0.0
- CVE-2026-27576OpenClaw: ACP prompt-size checks missing in local stdio bridge could reduce responsiveness with very large inputsnpm · openclaw · fixed in 2026.2.19