Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-61668@plone/volto vulnerable to potential DoS by invoking specific URL by anonymous usernpm · @plone/volto · fixed in 16.34.1, 17.22.2, 18.27.2 and more
- CVE-2025-56514Cross Site Scripting (XSS) vulnerability in Fiora chat application 1.0.0 allows executes arbitrary JavaScript when malicious SVG files are rnpm · fiora
- CVE-2025-56515File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality.npm · fiora
- CVE-2025-11149This affects all versions of the package node-static; all versions of the package @nubosoftware/node-static.npm · @nubosoftware/node-static
- CVE-2025-11148All versions of the package check-branches are vulnerable to Command Injection check-branches is a command-line tool that is interacted withnpm · check-branches
- CVE-2025-56200A URL validation bypass vulnerability exists in validator.js through version 13.15.15.npm · validator · fixed in 13.15.20
- CVE-2025-56571Finance.js v4.1.0 contains a Denial of Service (DoS) vulnerability via the IRR function’s depth parameter.npm · financejs
- CVE-2025-56572An issue in finance.js v.4.1.0 allows a remote attacker to cause a denial of service via the seekZero() parameter.npm · financejs
- CVE-2025-3193Versions of the package algoliasearch-helper from 2.0.0-rc1 and before 3.11.2 are vulnerable to Prototype Pollution in the _merge() functionnpm · algoliasearch-helper · fixed in 3.11.2
- CVE-2025-59936get-jwks poisoned JWKS cache allows post-fetch issuer validation bypassnpm · get-jwks · fixed in 11.0.2
- CVE-2025-59845Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypassnpm · @apollo/explorer, @apollo/sandbox · fixed in 3.7.3, 2.7.2
- CVE-2020-36851Rob--W cors-anywhere Misconfigured CORS Proxy Allows SSRFnpm · cors-anywhere
- CVE-2025-59426lobe-chat has an Open Redirectnpm · @lobehub/chat · fixed in 1.130.1
- CVE-2025-59834Command Injection in adb-mcp MCP Servernpm · adb-mcp
- CVE-2025-59831`git-comiters` Command Injection vulnerabilitynpm · git-commiters · fixed in 0.1.2
- CVE-2025-26278A prototype pollution in the lib.set function of dref v0.1.2 allows attackers to cause a Denial of Service (DoS) via supplying a crafted paynpm · dref
- CVE-2025-57317apidoc-core is the core parser library to generate apidoc result following the apidoc-spec.npm · apidoc-core
- CVE-2025-59828Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn Versionsnpm · @anthropic-ai/claude-code · fixed in 1.0.39
- CVE-2025-59343tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarballnpm · tar-fs · fixed in 3.1.1, 2.1.4, 1.16.6
- CVE-2025-57318A Prototype Pollution vulnerability in the toCsv function of csvjson versions thru 5.1.0 allows attackers to inject properties on Object.pronpm · csvjson
- CVE-2025-57320json-schema-editor-visual is a package that provides jsonschema editor.npm · json-schema-editor-visual
- CVE-2025-57321A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 allows attackers to injnpm · magix-combine-ex
- CVE-2025-57323mpregular is a package that provides a small program development framework based on RegularJS.npm · mpregular
- CVE-2025-57324parse is a package designed to parse JavaScript SDK.npm · parse · fixed in 7.0.0-alpha.1
- CVE-2025-57325rollbar is a package designed to effortlessly track and debug errors in JavaScript applications.npm · rollbar · fixed in 2.26.5, 3.0.0-beta5
- CVE-2025-57326A Prototype Pollution vulnerability in the byGroupAndType function of sassdoc-extras v2.5.1 and before allows attackers to inject propertiesnpm · sassdoc-extras
- CVE-2025-57327spmrc is a package that provides the rc manager for spm.npm · spmrc
- CVE-2025-57328toggle-array is a package designed to enables a property on the object at the specified index, while disabling the property on all other objnpm · toggle-array
- CVE-2025-57329web3-core-method is a package designed to creates the methods on the web3 modules.npm · web3-core-method
- CVE-2025-57330The web3-core-subscriptions is a package designed to manages web3 subscriptions.npm · web3-core-subscriptions