Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-55305Electron is vulnerable to Code Injection via resource modificationnpm · electron · fixed in 35.7.5, 36.8.1, 37.3.1 and more
- CVE-2025-58358Markdownify is vulnerable to command injection through pptx-to-markdown toolnpm · mcp-markdownify-server · fixed in 0.0.2
- CVE-2025-58064CKEditor is susceptible to Cross-Site Scripting (XSS) through its clipboard packagenpm · @ckeditor/ckeditor5-clipboard, ckeditor5 · fixed in 45.2.2, 46.0.3
- CVE-2025-57752Next.js Affected by Cache Key Confusion for Image Optimization API Routesnpm · next · fixed in 14.2.31, 15.4.5
- CVE-2025-55173Next.js Content Injection Vulnerability for Image Optimizationnpm · next · fixed in 14.2.31, 15.4.5
- CVE-2025-57822Next.js Improper Middleware Redirect Handling Leads to SSRFnpm · next · fixed in 14.2.32, 15.4.7
- CVE-2025-9654AiondaDotCom mcp-ssh server-simple.mjs command injectionnpm · @aiondadotcom/mcp-ssh · fixed in 1.1.0
- CVE-2025-4644User Session Fixation after Account Removal in PayloadCMSnpm · @payloadcms/graphql, @payloadcms/next +1 · fixed in 3.44.0
- CVE-2025-4643Lack of JWT Expiration after Log Out in PayloadCMSnpm · @payloadcms/graphql, @payloadcms/next +1 · fixed in 3.44.0
- CVE-2025-58047Volto affected by possible DoS by invoking specific URL by anonymous usernpm · @plone/volto · fixed in 16.34.0, 17.22.1, 18.24.0 and more
- CVE-2025-50979NodeBB v4.3.0 is vulnerable to SQL injection in its search-categories API endpoint (/api/v3/search/categories).npm · nodebb
- CVE-2025-57820Svelte devalue vulnerable to prototype pollutionnpm · devalue · fixed in 5.3.2
- CVE-2025-57810jsPDF Parsing of Corrupt PNGs Leads to Potential Denial of Service (DoS)npm · jspdf · fixed in 3.0.2
- CVE-2025-57814request-filtering-agent SSRF Bypass via HTTPS Requestsnpm · request-filtering-agent · fixed in 2.0.0
- CVE-2025-43761A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Qnpm · liferay-ckeditor · fixed in 4.21.0-liferay.10
- CVE-2025-57755claude-code-router CORS. misconfigurationnpm · @musistudio/claude-code-router · fixed in 1.0.34
- CVE-2025-57753vite-plugin-static-copy files not included in `src` are accessible with a crafted requestnpm · vite-plugin-static-copy · fixed in 3.1.2, 2.3.2
- CVE-2025-9262wong2 mcp-cli oAuth provider.js redirectToAuthorization os command injectionnpm · @wong2/mcp-cli
- CVE-2025-9288Missing type checks leading to hash rewind and passing on crafted datanpm · sha.js · fixed in 2.4.12
- CVE-2025-57749n8n has a symlink traversal vulnerability in "Read/Write File" node allows access to restricted filesnpm · n8n · fixed in 1.106.0
- CVE-2025-9287Missing type checks leading to hash rewind and passing on crafted datanpm · cipher-base · fixed in 1.0.5
- CVE-2025-55746Directus allows unauthenticated file upload and file modification due to lacking input sanitizationnpm · @directus/api, directus · fixed in 28.0.2, 11.9.3
- CVE-2025-50864An Origin Validation Error in the elysia-cors library thru 1.3.0 allows attackers to bypass Cross-Origin Resource Sharing (CORS) restrictionnpm · @elysiajs/cors · fixed in 1.3.1
- CVE-2025-55303Unauthorized third-party images in Astro’s _image endpointnpm · @astrojs/node, astro · fixed in 9.1.1, 5.13.2, 4.16.19
- CVE-2025-55294Command Injection via `format` option in screenshot-desktopnpm · screenshot-desktop · fixed in 1.15.2
- CVE-2025-54881Mermaid improperly sanitizes of sequence diagram labels leading to XSSnpm · mermaid · fixed in 11.10.0, 10.9.4
- CVE-2025-54880Mermaid does not properly sanitize architecture diagram iconText leading to XSSnpm · mermaid · fixed in 11.10.0
- CVE-2025-52478Stored XSS in n8n Form Trigger allows Account Takeover via injected iframe and video/sourcenpm · n8n · fixed in 1.98.2
- CVE-2025-9096ExpressGateway express-gateway REST Endpoint apps.js cross site scriptingnpm · express-gateway
- CVE-2025-9095ExpressGateway express-gateway REST Endpoint users.js cross site scriptingnpm · express-gateway