Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-49826Next.js DoS vulnerability via cache poisoningnpm · next · fixed in 15.1.8
- CVE-2025-49005Next.js cache poisoning due to omission of Vary headernpm · next · fixed in 15.3.3
- CVE-2025-52554n8n Improper Authorization in Workflow Execution Stop Endpoint Allows Terminating Other Users’ Workflowsnpm · n8n · fixed in 1.99.1
- CVE-2025-48939tarteaucitron.js vulnerable to DOM Clobbering via document.currentScriptnpm · tarteaucitronjs · fixed in 1.22.0
- CVE-2025-49595n8n Vulnerable to Denial of Service via Malformed Binary Data Requestsnpm · n8n · fixed in 1.99.0
- CVE-2025-53109Model Context Protocol Servers Vulnerable to Path Validation Bypass via Prefix Matching and Symlink Handlingnpm · @modelcontextprotocol/server-filesystem · fixed in 2025.7.1
- CVE-2025-53110Model Context Protocol Servers Vulnerable to Path Validation Bypass via Colliding Path Prefixnpm · @modelcontextprotocol/server-filesystem · fixed in 2025.7.1
- CVE-2025-53107@cyanheads/git-mcp-server vulnerable to command injection in several toolsnpm · @cyanheads/git-mcp-server · fixed in 2.1.5
- CVE-2024-49364tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled environmentnpm · tiny-secp256k1 · fixed in 1.1.7
- CVE-2024-49365tiny-secp256k1 allows for verify() bypass when running in bundled environmentnpm · tiny-secp256k1 · fixed in 1.1.7
- CVE-2024-46993Electron Vulnerable to Heap Buffer Overflow in NativeImage::CreateFromPathnpm · electron · fixed in 28.3.2, 29.3.3, 30.0.3
- CVE-2024-46992Electron ASAR Integrity bypass by just modifying the contentnpm · electron · fixed in 30.0.5, 31.0.0-beta.1
- CVE-2025-45143string-math v1.2.2 was discovered to contain a Regex Denial of Service (ReDoS) which is exploited via a crafted input.npm · string-math
- CVE-2025-49592n8n Login Flow has Open Redirect Vulnerabilitynpm · n8n · fixed in 1.98.0
- CVE-2025-52573Command Injection in MCP Server ios-simulator-mcpnpm · ios-simulator-mcp · fixed in 1.3.3
- CVE-2025-6624Versions of the package snyk before 1.1297.3 are vulnerable to Insertion of Sensitive Information into Log File through local Snyk CLI debugnpm · snyk · fixed in 1.1297.3
- CVE-2025-52882Claude Code IDE extensions allow websocket connections from arbitrary originsnpm · @anthropic-ai/claude-code · fixed in 1.0.24
- CVE-2025-6547On Node.js < 3, pbkdf2 silently disregards Uint8Array input, returning static keysnpm · pbkdf2 · fixed in 3.1.3
- CVE-2025-6545pbkdf2 silently returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos supported by Node.jsnpm · pbkdf2 · fixed in 3.1.3
- CVE-2025-50183OpenList (frontend) allows XSS Attacks in the built-in Markdown Viewernpm · @openlist-frontend/openlist-frontend · fixed in 4.0.0-rc.4
- CVE-2025-6087SSRF vulnerability in opennextjs-cloudflare via /_next/image endpointnpm · @opennextjs/cloudflare · fixed in 1.17.1, 1.3.0
- CVE-2025-49596MCP Inspector proxy server lacks authentication between the Inspector client and proxynpm · @modelcontextprotocol/inspector · fixed in 0.14.1
- CVE-2025-29744pg-promise before 11.5.5 is vulnerable to SQL Injection due to improper handling of negative numbers.npm · pg-promise · fixed in 11.5.5
- CVE-2025-36852Build Cache Poisoning via Untrusted Pull Requestsnpm · @nx/azure-cache
- CVE-2024-57186In Erxes <1.6.2, an unauthenticated attacker can read arbitrary files from the system using a Path Traversal vulnerability in the /read-filenpm · erxes · fixed in 1.6.2
- CVE-2024-57189In Erxes <1.6.2, an authenticated attacker can write to arbitrary files on the system using a Path Traversal vulnerability in the importHistnpm · erxes · fixed in 1.6.2
- CVE-2024-57190Erxes <1.6.1 is vulnerable to Incorrect Access Control.npm · erxes · fixed in 1.6.1
- CVE-2025-49141HaxCMS-PHP Command Injection Vulnerabilitynpm · @haxtheweb/haxcms-nodejs · fixed in 11.0.3
- CVE-2025-49139@haxtheweb/haxcms-nodejs Iframe Phishing vulnerabilitynpm · @haxtheweb/haxcms-nodejs · fixed in 11.0.0
- CVE-2025-5897vuejs vue-cli Markdown Code HtmlPwaPlugin.js HtmlPwaPlugin redosnpm · @vue/cli-plugin-pwa