Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-68273Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpointsnpm · signalk-server · fixed in 2.19.0
- CVE-2025-68272Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Floodingnpm · signalk-server · fixed in 2.19.0
- CVE-2025-66398Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)npm · signalk-server · fixed in 2.19.0
- CVE-2025-69256serverless MCP Server vulnerable to command injection in list-projects toolnpm · serverless · fixed in 4.29.3
- CVE-2025-15284arrayLimit bypass in bracket notation allows DoS via memory exhaustionnpm · qs · fixed in 6.14.1
- CVE-2025-69202axios-cache-interceptor Vulnerable to Cache Poisoning via Ignored HTTP Vary Headernpm · axios-cache-interceptor · fixed in 1.11.1
- CVE-2025-69211Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)npm · @nestjs/platform-fastify · fixed in 11.1.11
- CVE-2025-69206Hemmelig has SSRF Filter bypass in Secret Request functionalitynpm · hemmelig · fixed in 7.3.3
- CVE-2025-68697Self-hosted n8n has Legacy Code node that enables arbitrary file read/writenpm · n8n · fixed in 2.0.0
- CVE-2025-68668n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Nodenpm · n8n · fixed in 2.0.0
- CVE-2025-61914n8n's Possible Stored XSS in "Respond to Webhook" Node May Execute Outside iframe Sandboxnpm · n8n · fixed in 1.114.0
- CVE-2025-13158apidoc-core - prototype pollution in api_group.js, api_param_title.js, api_use.js, and api_permission.js workernpm · apidoc-core
- CVE-2025-25341A vulnerability exists in the libxmljs 1.0.11 when parsing a specially crafted XML document.npm · libxmljs
- CVE-2025-68665LangChain serialization injection vulnerability enables secret extractionnpm · @langchain/core, langchain · fixed in 1.1.8, 0.3.80, 1.2.3 and more
- CVE-2025-68475Fedify has ReDoS Vulnerability in HTML Parsing Regexnpm · @fedify/fedify · fixed in 1.6.13, 1.7.14, 1.8.15 and more
- CVE-2025-68613n8n Vulnerable to Remote Code Execution via Expression Injectionnpm · n8n · fixed in 1.120.4, 1.121.1
- CVE-2025-68457Orejime has executable code in HTML attributesnpm · orejime · fixed in 2.3.2
- CVE-2025-68278tinacms vulnerable to arbitrary code executionnpm · @tinacms/cli, @tinacms/graphql +1 · fixed in 2.0.4, 2.0.3, 3.1.1
- CVE-2025-14874Nodemailer: nodemailer: denial of service via crafted email address headernpm · nodemailer · fixed in 7.0.11
- CVE-2025-68429Storybook manager bundle may expose environment variables during buildnpm · storybook · fixed in 7.6.21, 8.6.15, 9.1.17 and more
- CVE-2025-13321Mattermost Desktop App logging sensitive information and fails to clear data on server deletionnpm · mattermost-desktop
- CVE-2025-68155@vitejs/plugin-rsc has Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint on Developmentnpm · @vitejs/plugin-rsc · fixed in 0.5.8
- CVE-2025-68154Command Injection in fsSize() on Windowsnpm · systeminformation · fixed in 5.27.14
- CVE-2025-68150Parse Server has Server-Side Request Forgery (SSRF) in Instagram OAuth Adapternpm · parse-server · fixed in 9.1.1-alpha.1, 8.6.2
- CVE-2025-68130tRPC has possible prototype pollution in `experimental_nextAppDirCaller`npm · @trpc/server · fixed in 10.45.3, 11.8.0
- CVE-2025-68115Parse Server vulnerable to Cross-Site Scripting (XSS) via Unescaped Mustache Template Variablesnpm · parse-server · fixed in 8.6.1, 9.1.0-alpha.3
- CVE-2025-68113ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replaynpm · altcha-lib · fixed in 1.4.1
- CVE-2025-66482Misskey has a login rate limit bypass via spoofed X-Forwarded-For headernpm · misskey-js · fixed in 2025.12.0-alpha.2
- CVE-2025-66402misskey.js's export data contains private post datanpm · misskey-js · fixed in 2025.12.0
- CVE-2025-67898MJML through 4.18.0 allows mj-include directory traversal to test file existence and (in the type="css" case) read files.npm · mjml · fixed in 5.0.0-alpha.9