Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-54369Node-SAML SAML Authentication Bypassnpm · @node-saml/node-saml, node-saml · fixed in 5.1.0
- CVE-2025-67750Lightning Flow Scanner is Vulnerable to Code Injection via Unsafe Use of new Function() in APIVersion Rulenpm · lightning-flow-scanner · fixed in 6.10.6
- CVE-2025-8083Vuetify Prototype Pollution via Preset optionsnpm · vuetify · fixed in 3.0.0-alpha.10
- CVE-2025-8082Vuetify XSS via unsanitized 'titleDateFormat' in 'VDatePicker'npm · vuetify · fixed in 3.0.0
- CVE-2025-67731Servify Express does not enforce rate limiting when parsing JSONnpm · servify-express · fixed in 1.2
- CVE-2025-67779It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attacnpm · react-server-dom-parcel, react-server-dom-turbopack +1 · fixed in 19.0.3, 19.1.4, 19.2.3
- CVE-2025-55184A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.npm · react-server-dom-parcel, react-server-dom-turbopack +1 · fixed in 19.0.2, 19.1.3, 19.2.2
- CVE-2025-55183An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.npm · react-server-dom-parcel, react-server-dom-turbopack +1 · fixed in 19.0.2, 19.1.3, 19.2.2
- CVE-2025-67718Formio improperly authorized permission elevation through specially crafted request pathnpm · formio · fixed in 3.5.7, 4.4.3
- CVE-2025-67716Auth0 Next.js SDK has Improper Validation of Query Parametersnpm · @auth0/nextjs-auth0 · fixed in 4.13.0
- CVE-2025-67490Auth0 Next.js SDK has Improper Request Caching Lookupnpm · @auth0/nextjs-auth0 · fixed in 4.11.2, 4.12.1
- CVE-2025-67489@vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development servernpm · @vitejs/plugin-rsc · fixed in 0.5.6
- CVE-2025-66457Elysia affected by arbitrary code injection through cookie confignpm · elysia · fixed in 1.4.18
- CVE-2025-66456Elysia vulnerable to prototype pollution with multiple standalone schema validationnpm · elysia · fixed in 1.4.17
- CVE-2025-14284Versions of the package @tiptap/extension-link before 2.10.4 are vulnerable to Cross-site Scripting (XSS) due to unsanitized user input allonpm · @tiptap/extension-link · fixed in 2.10.4
- CVE-2025-65513fetch-mcp v1.0.2 and before is vulnerable to Server-Side Request Forgery (SSRF) vulnerability, which allows attackers to bypass private IP vnpm · mcp-fetch-server
- CVE-2025-66202Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765npm · astro · fixed in 5.15.8
- CVE-2025-65964n8n Vulnerable to Remote Code Execution via Git Node Custom Pre-Commit Hooknpm · n8n · fixed in 1.119.2
- CVE-2025-65849A cryptanalytic break in Altcha Proof-of-Work obfuscation mode version 0.8.0 and later allows for remote visitors to recover the Proof-of-Wonpm · altcha
- CVE-2025-66479Anthropic Sandbox Runtime Incorrectly Implemented Network Sandboxingnpm · @anthropic-ai/sandbox-runtime · fixed in 0.0.16
- CVE-2025-65959Open WebUI vulnerable to Stored DOM XSS via Note 'Download PDF'npm · open-webui · fixed in 0.6.37
- CVE-2025-65945auth0/node-jws improper HMAC signature verification vulnerabilitynpm · jws · fixed in 3.2.3, 4.0.1
- CVE-2025-66404mcp-server-kubernetes potential security issue in exec_in_pod toolnpm · mcp-server-kubernetes · fixed in 2.9.8
- CVE-2025-66032Claude Code Command Validation Bypass Allows Arbitrary Code Executionnpm · @anthropic-ai/claude-code · fixed in 1.0.93
- CVE-2025-55182A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0…npm · react-server-dom-parcel, react-server-dom-turbopack +1 · fixed in 19.0.1, 19.1.2, 19.2.1
- CVE-2025-66414DNS Rebinding Protection Disabled by Default in Model Context Protocol TypeScript SDK for Servers Running on Localhostnpm · @modelcontextprotocol/sdk · fixed in 1.24.0
- CVE-2025-13877nocobase JWT Service jwt-service.ts hard-coded keynpm · @nocobase/auth · fixed in 1.9.23, 1.9.0-beta.18, 2.0.0-alpha.52
- CVE-2025-66401MCP Watch has a Critical Command Injection in cloneRepo allows Remote Code Execution (RCE) via malicious URLnpm · mcp-watch
- CVE-2025-66415fastify-reply-from bypass of reply forwardingnpm · @fastify/reply-from · fixed in 12.5.0
- CVE-2025-66412Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributesnpm · @angular/compiler · fixed in 21.0.2, 20.3.15, 19.2.17