Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-23835LobeHub Vulnerable to Improper Authorization in Presigned Uploadnpm · @lobehub/chat · fixed in 1.143.3
- CVE-2026-25128fast-xml-parser has RangeError DoS Numeric Entities Bugnpm · fast-xml-parser · fixed in 5.3.4
- CVE-2026-25050Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategynpm · @vendure/core · fixed in 3.5.3
- CVE-2026-25047deepHas vulnerable to Prototype Pollution via constructor.prototypenpm · deephas · fixed in 1.0.8
- CVE-2026-24888Maker.js Vulnerable to Unsafe Property Copying in makerjs.extendObjectnpm · makerjs · fixed in 0.19.2
- CVE-2026-24769NocoDB Vulnerable to Stored Cross-Site Scripting via SVG uploadnpm · nocodb · fixed in 0.301.0
- CVE-2026-24768NocoDB has Unvalidated Redirect in Login Flow via continueAfterSignIn Parameternpm · nocodb · fixed in 0.301.0
- CVE-2026-24767NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionalitynpm · nocodb · fixed in 0.301.0
- CVE-2026-24766NocoDB Vulnerable to Prototype Pollution in Connection Test Endpoint, Leading to DoSnpm · nocodb · fixed in 0.301.0
- CVE-2026-1513billboard.js before 3.18.0 allows an attacker to execute malicious JavaScript due to improper sanitization during chart option binding.npm · billboard.js · fixed in 3.18.0
- CVE-2026-24842node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversalnpm · tar · fixed in 7.5.7
- CVE-2025-57283The Node.js package browserstack-local 1.5.8 contains a command injection vulnerability.npm · browserstack-local · fixed in 1.5.9
- CVE-2025-61140The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.npm · jsonpath · fixed in 1.2.0
- CVE-2026-24134StudioCMS has an Authorization Bypass Through User-Controlled Keynpm · studiocms · fixed in 0.2.0
- CVE-2026-23830SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructornpm · @nyariv/sandboxjs · fixed in 0.8.26
- CVE-2026-24909vlt before 1.0.0-rc.10 mishandles path sanitization for tar, leading to path traversal during extraction.npm · @vltpkg/tar · fixed in 1.0.0-rc.10
- CVE-2026-24778Ghost vulnerable to XSS via malicious Portal preview linksnpm · @tryghost/portal, ghost · fixed in 2.51.5, 2.57.1, 5.121.0 and more
- CVE-2026-24771Hono has a Cross-site Scripting vulnerabilitynpm · hono · fixed in 4.11.7
- CVE-2026-24473Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)npm · hono · fixed in 4.11.7
- CVE-2026-24472Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deceptionnpm · hono · fixed in 4.11.7
- CVE-2026-24398Hono's IPv4 address validation bypass in IP Restriction Middleware allows IP spoofingnpm · hono · fixed in 4.11.7
- CVE-2026-1470Authenticated users can bypass the Expression sandbox mechanism to achieve full remote code execution on n8n’s main node.npm · n8n · fixed in 1.123.17, 2.4.5, 2.5.1
- CVE-2026-24131pnpm has Path Traversal via arbitrary file permission modificationnpm · pnpm · fixed in 10.28.2
- CVE-2026-24056pnpm has symlink traversal in file:/git dependenciesnpm · pnpm · fixed in 10.28.2
- CVE-2026-23890pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.binnpm · pnpm · fixed in 10.28.1
- CVE-2026-23889pnpm has Windows-specific tarball Path Traversalnpm · pnpm · fixed in 10.28.1
- CVE-2025-59472A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode.npm · next · fixed in 16.1.5, 15.6.0-canary.61
- CVE-2025-59471A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer.npm · next · fixed in 15.5.10, 16.1.5
- CVE-2026-23888pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)npm · pnpm · fixed in 10.28.1
- CVE-2026-22709vm2 has a Sandbox Escapenpm · vm2 · fixed in 3.10.2