Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-106488Backstage: Improper authentication in the OIDC providernpm · @backstage/plugin-auth-backend-module-oidc-provider · fixed in 0.4.20
- CVE-2026-106487Backstage: Unsupported catalog cluster authentication mode in kubernetes backendnpm · @backstage/plugin-kubernetes-backend · fixed in 0.21.10
- CVE-2026-106486Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actionsnpm · @backstage/plugin-scaffolder-backend-module-bitbucket-cloud, @backstage/plugin-scaffolder-backend-module-bitbucket-server · fixed in 0.3.10, 0.2.25
- CVE-2026-106463Backstage: Improper authorization in GitLab organizational user ingestionnpm · @backstage/plugin-catalog-backend-module-gitlab · fixed in 0.8.7
- CVE-2026-106462Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallbacknpm · @backstage/plugin-scaffolder-backend, @backstage/plugin-scaffolder-backend-module-azure +4 · fixed in 4.1.0, 0.2.25, 0.3.10 and more
- CVE-2026-106461Backstage: Incorrect authorization in scaffolder task listingnpm · @backstage/plugin-scaffolder-backend · fixed in 4.1.0
- CVE-2026-106460Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalizationnpm · @backstage/plugin-auth-node · fixed in 0.6.15, 0.7.5
- CVE-2026-106459Backstage: Improper input validation in Sentry scaffolder actionsnpm · @backstage/plugin-scaffolder-backend-module-sentry · fixed in 0.3.8
- CVE-2026-106458Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updatesnpm · @backstage/plugin-catalog-backend-module-bitbucket-server · fixed in 0.5.15
- CVE-2026-106457Backstage: Insufficient audience validation in the Cloudflare Access auth providernpm · @backstage/plugin-auth-backend-module-cloudflare-access-provider · fixed in 0.5.0
- CVE-2026-106456Backstage: Inconsistent credential enforcement for overlapping proxy routesnpm · @backstage/plugin-proxy-backend · fixed in 0.6.18
- CVE-2026-106455Backstage: Improper validation of MkDocs plugin configuration in TechDocsnpm · @backstage/plugin-techdocs-node · fixed in 1.14.7, 1.15.5
- CVE-2026-106448StableLib: Prototype poisoning via `__proto__` map keys in CBOR decodingnpm · @stablelib/cbor · fixed in 2.0.3
- CVE-2026-106447StableLib: Stack exhaustion denial of service via deeply nested CBOR arrays, maps, or tagsnpm · @stablelib/cbor · fixed in 2.0.3
- CVE-2026-106446Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)npm · handlebars · fixed in 4.7.10
- CVE-2026-106445Handlebars: JavaScript Injection via Own Property Check Bypassnpm · handlebars · fixed in 4.7.10
- CVE-2026-106444Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templatesnpm · handlebars · fixed in 4.7.10
- CVE-2026-106120LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iterationnpm · liquidjs · fixed in 10.27.2
- CVE-2026-106119LangChain: MongoDBChatMessageHistory query injection can allow cross-session accessnpm · @langchain/mongodb · fixed in 1.3.1
- CVE-2026-106109Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directoriesnpm · @quasar/app-vite · fixed in 3.3.0
- CVE-2026-106107Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrainednpm · @quasar/app-vite · fixed in 3.3.0
- CVE-2026-106106Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassablenpm · @quasar/app-vite, @quasar/render-ssr-error · fixed in 3.3.0, 2.2.4
- CVE-2026-106105Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissionsnpm · @quasar/app-vite, @quasar/cli +1 · fixed in 3.3.0, 5.0.4, 2.1.0
- CVE-2026-106104Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR servernpm · quasar · fixed in 2.23.3
- CVE-2026-106103Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profilenpm · @quasar/icongenie · fixed in 6.1.1
- CVE-2026-106102Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()npm · quasar · fixed in 2.22.0
- CVE-2026-106101Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Servicenpm · quasar · fixed in 2.32.2
- CVE-2026-106100Payload: Field-level write access bypass in Payload on MongoDBnpm · @payloadcms/db-mongodb · fixed in 3.87.0, 4.0.0-canary.20
- CVE-2026-105868Payload: Uploaded XML files could execute same-origin JavaScriptnpm · payload · fixed in 3.90.0, 4.0.0-canary.34
- CVE-2026-105867Payload: Client uploads could overwrite S3 objectsnpm · @payloadcms/storage-s3 · fixed in 3.90.0, 4.0.0-canary.34