Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-22595Ghost has Staff Token permission bypassnpm · ghost · fixed in 6.11.0, 5.130.6
- CVE-2026-22594Ghost has Staff 2FA bypassnpm · ghost · fixed in 6.11.0, 5.130.6
- CVE-2026-22030React Router has CSRF issue in Action/Server Action Request Processingnpm · @remix-run/server-runtime, react-router · fixed in 2.17.3, 7.12.0
- CVE-2026-22029React Router vulnerable to XSS via Open Redirectsnpm · @remix-run/router, react-router · fixed in 1.23.2, 7.12.0
- CVE-2026-21884React Router SSR XSS in ScrollRestorationnpm · @remix-run/react, react-router · fixed in 2.17.3, 7.12.0
- CVE-2025-61686React Router has Path Traversal in File Session Storagenpm · @react-router/node, @remix-run/deno +1 · fixed in 7.9.4, 2.17.2
- CVE-2025-59057React Router has XSS Vulnerabilitynpm · @remix-run/react, react-router · fixed in 2.17.1, 7.9.0
- CVE-2025-68470React Router has unexpected external redirect via untrusted pathsnpm · react-router · fixed in 6.30.2, 7.9.6
- CVE-2025-14505Elliptic Cryptanalysis vulnerability when `k` has leading zerosnpm · elliptic
- CVE-2026-22032Directus has open redirect in SAMLnpm · @directus/api, directus · fixed in 32.1.1, 11.14.0
- CVE-2026-22028Preact has JSON VNode Injection issuenpm · preact · fixed in 10.26.10, 10.27.3, 10.28.2
- CVE-2026-21894n8n's Missing Stripe-Signature Verification Allows Unauthenticated Forged Webhooksnpm · n8n · fixed in 2.2.2
- CVE-2026-21877n8n is vulnerable to Remote Code Execution via Arbitrary File Writenpm · n8n · fixed in 1.121.3
- CVE-2026-21858n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handlingnpm · n8n · fixed in 1.121.0
- CVE-2025-69262pnpm vulnerable to Command Injection via environment variable substitutionnpm · pnpm · fixed in 10.27.0
- CVE-2025-69264pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"npm · pnpm · fixed in 10.26.0
- CVE-2025-69263pnpm Lockfile Integrity Bypass Allows Remote Dynamic Dependenciesnpm · pnpm · fixed in 10.26.0
- CVE-2025-9611Microsoft Playwright MCP Server < 0.0.40 DNS Rebinding via Missing Origin Header Validationnpm · @playwright/mcp · fixed in 0.0.40
- CVE-2024-14020carboneio carbone Formatter input.js prototype pollutionnpm · carbone · fixed in 3.5.6
- CVE-2025-67364fast-filesystem-mcp version 3.4.0 contains a critical path traversal vulnerability in its file operation tools including fast_read_file.npm · fast-filesystem-mcp
- CVE-2025-68428jsPDF has Local File Inclusion/Path Traversal vulnerabilitynpm · jspdf · fixed in 4.0.0
- CVE-2025-66648`vega-functions` vulnerable to Cross-site Scripting via `setdata` functionnpm · vega-functions · fixed in 6.1.1
- CVE-2025-65110Vega Cross-Site Scripting (XSS) via expression abusing vlSelectionTuples function array map calls in environments with satisfactory function gadgets in the global scopenpm · vega-selections · fixed in 5.6.3, 6.1.2
- CVE-2026-0621MCP TypeScript SDK UriTemplate Exploded Array Pattern ReDoSnpm · @modelcontextprotocol/sdk · fixed in 1.25.2
- CVE-2025-67419A Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server's resnpm · @evershop/evershop
- CVE-2025-67427A Blind Server-Side Request Forgery (SSRF) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to force the server tonpm · @evershop/evershop
- CVE-2026-21440AdonisJS Path Traversal in Multipart File Handlingnpm · @adonisjs/bodyparser · fixed in 10.1.2, 11.0.0-next.6
- CVE-2025-69203Signal K Server Vulnerable to Access Request Spoofingnpm · signalk-server · fixed in 2.19.0
- CVE-2025-68619Signal K Server Vulnerable to Remote Code Execution via Malicious npm Packagenpm · signalk-server · fixed in 2.9.0
- CVE-2025-68620Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Pollingnpm · signalk-server · fixed in 2.19.0