Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-57164Flowise through v3.0.4 is vulnerable to remote code execution via unsanitized evaluation of user input in the "Supabase RPC Filter" field.npm · flowise · fixed in 3.0.6
- CVE-2025-62427Server-Side Request Forgery (SSRF) in Angular SSRnpm · @angular/ssr · fixed in 19.2.18, 20.3.6, 21.0.0-next.8
- CVE-2025-53092Strapi core vulnerable to sensitive data exposure via CORS misconfigurationnpm · @strapi/core · fixed in 5.20.0
- CVE-2025-25298Missing Maximum Password Length Validation in Strapi Password Hashingnpm · @strapi/core · fixed in 5.10.3
- CVE-2024-56143Strapi Allows Unauthorized Access to Private Fields via parms.lookupnpm · @strapi/core · fixed in 5.5.2
- CVE-2025-3930Lack of JWT Expiration after Log Out in Strapinpm · @strapi/strapi · fixed in 5.24.1
- CVE-2025-62410--disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-domnpm · happy-dom · fixed in 20.0.2
- CVE-2025-62381sveltekit-superforms Prototype Pollution in `parseFormData` function of `formData.js`npm · sveltekit-superforms · fixed in 2.27.4
- CVE-2025-62378CommandKit exposes incorrect command name in context object for message command aliasesnpm · commandkit · fixed in 1.2.0-rc.12
- CVE-2025-62380Mailgen has HTML Injection and XSS Filter Bypass in Plaintext Emailsnpm · mailgen · fixed in 2.0.32
- CVE-2025-62374Parse Javascript SDK vulnerable to prototype pollution in `Parse.Object` and internal APIsnpm · parse · fixed in 7.0.0
- CVE-2025-34267Flowise Authenticated Command Execution and Sandbox Bypass via Puppeteer & Playwright Packagesnpm · flowise · fixed in 3.0.8
- CVE-2025-59288Playwright Spoofing Vulnerabilitynpm · playwright · fixed in 1.55.1
- CVE-2025-62366Mailgen vulnerable to HTML injection and cross-site scripting via plaintext email generationnpm · mailgen · fixed in 2.0.31
- CVE-2025-11183Cross-Site Scripting Vulnerability in QWC2npm · qwc2 · fixed in 2025.8.14
- CVE-2025-61927Happy-DOM has VM Context Escapenpm · happy-dom · fixed in 20.0.0
- CVE-2025-61925Astro's `X-Forwarded-Host` is reflected with no validationnpm · astro · fixed in 5.14.3
- CVE-2025-61928Better Auth: Unauthenticated API key creation through api-key pluginnpm · better-auth · fixed in 1.3.26
- CVE-2025-61913Flowise is vulnerable to arbitrary file read, arbitrary file writenpm · flowise, flowise-components · fixed in 3.0.8
- CVE-2025-53967Framelink Figma MCP Server before 0.6.3 allows an unauthenticated remote attacker to execute arbitrary operating system commands via a craftnpm · figma-developer-mcp · fixed in 0.6.3
- CVE-2025-11362Versions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throtnpm · pdfmake · fixed in 0.3.0-beta.17
- CVE-2025-61687FlowiseAI/Flosise has File Upload vulnerabilitynpm · flowise · fixed in 3.0.8
- CVE-2025-59159SillyTavern Web Interface Vulnerable to DNS Rebindingnpm · sillytavern · fixed in 1.13.4
- CVE-2025-29192Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log.npm · flowise · fixed in 3.0.5
- CVE-2025-50538Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log.npm · flowise · fixed in 3.0.8
- CVE-2025-11287samanhappy MCPHub sseService.ts handleSseConnectionfunction improper authenticationnpm · @samanhappy/mcphub
- CVE-2025-11285samanhappy MCPHub serverController.ts os command injectionnpm · @samanhappy/mcphub
- CVE-2025-61685Mastra Docs MCP Server `@mastra/mcp-docs-server` Leads to Information Exposurenpm · @mastra/mcp-docs-server · fixed in 0.17.0
- CVE-2025-59829Claude Code: Permission deny bypass is possible through symlinknpm · @anthropic-ai/claude-code · fixed in 1.0.120
- CVE-2025-59536Claude Code's startup trust dialog could lead to Command Execution attacknpm · @anthropic-ai/claude-code · fixed in 1.0.111