Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-2327Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the npm · markdown-it · fixed in 14.1.1
- CVE-2026-2391qs's arrayLimit bypass in comma parsing allows denial of servicenpm · qs · fixed in 6.14.2
- CVE-2026-0969Arbitrary code execution in React server-side rendering of untrusted MDX contentnpm · next-mdx-remote · fixed in 6.0.0
- CVE-2025-56647npm @farmfe/core before 1.7.6 is Missing Origin Validation in WebSocket.npm · @farmfe/core · fixed in 1.7.6
- CVE-2026-26021Prototype pollution in set-innpm · set-in · fixed in 2.0.5
- CVE-2026-26019@langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validationnpm · @langchain/community · fixed in 1.1.14
- CVE-2025-69873ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enanpm · ajv · fixed in 8.18.0, 6.14.0
- CVE-2025-69874nanotar through 0.2.0 has a path traversal vulnerability in parseTar() and parseTarGzip() that allows remote attackers to write arbitrary finpm · nanotar
- CVE-2026-1774CASL Ability, versions 2.4.0 through 6.7.4, contains a prototype pollution vulnerability.npm · @casl/ability · fixed in 6.7.5
- CVE-2026-25958Cube privilege escalation via a specially crafted requestnpm · @cubejs-backend/server-core · fixed in 1.0.14, 1.4.2, 1.5.13
- CVE-2026-25957Cube Denial of Service (DoS) - An authenticated attacker can crash the server by sending a specially crafted requestnpm · @cubejs-backend/server-core · fixed in 1.4.2, 1.5.13
- CVE-2026-25895FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload APInpm · fuxa-server · fixed in 1.2.10
- CVE-2026-25894FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configurationnpm · fuxa-server · fixed in 1.2.10
- CVE-2026-25893FUXA Unauthenticated Remote Code Execution via Admin JWT Mintingnpm · fuxa-server · fixed in 1.2.10
- CVE-2026-25951FUXA has a Path Traversal Sanitization Bypassnpm · fuxa-server · fixed in 1.2.11
- CVE-2026-25939FUXA Unauthenticated Remote Arbitrary Scheduler Writenpm · fuxa-server · fixed in 1.2.11
- CVE-2026-25938FUXA Unauthenticated Remote Code Execution in Node-RED Integrationnpm · fuxa-server · fixed in 1.2.11
- CVE-2026-25918unity-cli Exposes Plaintext Credentials in Debug Logs (sign-package command)npm · @rage-against-the-pixel/unity-cli · fixed in 1.8.2
- CVE-2026-25881@nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape)npm · @nyariv/sandboxjs · fixed in 0.8.31
- CVE-2026-25639Axios affected by Denial of Service via __proto__ Key in mergeConfignpm · axios · fixed in 1.13.5, 0.30.3
- CVE-2026-25528LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injectionnpm · langsmith · fixed in 0.4.6
- CVE-2026-1615Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path exnpm · jsonpath · fixed in 1.3.0
- CVE-2026-2178r-huijts xcode-mcp-server run_lldb index.ts registerXcodeTools command injectionnpm · xcode-mcp-server
- CVE-2026-2130BurtTheCoder mcp-maigret search_username index.ts command injectionnpm · mcp-maigret · fixed in 1.0.13
- CVE-2026-25762AdonisJS vulnerable to Denial of Service (DoS) via Unrestricted Memory Buffering in PartHandler during File Type Detectionnpm · @adonisjs/bodyparser · fixed in 10.1.3, 11.0.0-next.9
- CVE-2026-25754AdonisJS multipart body parsing has Prototype Pollution issuenpm · @adonisjs/bodyparser · fixed in 10.1.3, 11.0.0-next.9
- CVE-2026-25533Enclave has a sandbox escape via infinite recursion and error objectsnpm · @enclave-vm/core, enclave-vm · fixed in 2.10.1
- CVE-2026-25544Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adaptersnpm · @payloadcms/drizzle · fixed in 3.73.0
- CVE-2026-25574Payload Affected by Cross-Collection IDOR in payload-preferences Access Control (Multi-Auth Environments)npm · payload · fixed in 3.74.0
- CVE-2026-25581SCEditor affected by DOM XSS via emoticon URL/HTML injectionnpm · sceditor · fixed in 3.2.1