Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-47828Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings.npm · @lumieducation/h5p-server · fixed in 9.3.3
- CVE-2025-47269code-server session cookie can be extracted by having user visit specially crafted proxy URLnpm · code-server · fixed in 4.99.4
- CVE-2025-46812Trix vulnerable to Cross-site Scripting on copy & pastenpm · trix · fixed in 2.1.15
- CVE-2025-46573passport-wsfed-saml2 Has SAML Authentication Bypass via Attribute Smugglingnpm · passport-wsfed-saml2 · fixed in 4.6.4
- CVE-2025-46572passport-wsfed-saml2 Has SAML Authentication Bypass via Signature Wrappingnpm · passport-wsfed-saml2 · fixed in 4.6.4
- CVE-2025-46720Keystone has an unintended `isFilterable` bypass that can be used as an oracle to match hidden fieldsnpm · @keystone-6/core · fixed in 6.5.0
- CVE-2025-46553@misskey-dev/summaly Redirect Filter Bypassnpm · @misskey-dev/summaly · fixed in 5.2.1
- CVE-2025-4318Input validation issue in AWS Amplify Studio UI component propertiesnpm · @aws-amplify/codegen-ui-react · fixed in 2.20.3
- CVE-2025-46332Information Disclosure via Flags override linknpm · @vercel/flags, flags · fixed in 4.0.0
- CVE-2025-46565Vite's server.fs.deny bypassed with /. for files under project rootnpm · vite · fixed in 6.3.4, 6.2.7, 6.1.6 and more
- CVE-2025-4144PKCE bypass via downgrade attacknpm · @cloudflare/workers-oauth-provider · fixed in 0.0.5
- CVE-2025-4143Missing validation of redirect_uri on authorize endpointnpm · @cloudflare/workers-oauth-provider · fixed in 0.0.5
- CVE-2025-27611base-x homograph attack allows Unicode lookalike characters to bypass validation.npm · base-x · fixed in 5.0.1, 4.0.1, 3.0.11
- CVE-2025-46344Auth0 NextJS SDK v4 Missing Session Invalidationnpm · @auth0/nextjs-auth0 · fixed in 4.5.1
- CVE-2025-0716AngularJS improper sanitization in SVG '<image>' elementnpm · angular
- CVE-2025-46343n8n Vulnerable to Stored XSS through Attachments View Endpointnpm · n8n · fixed in 1.90.0
- CVE-2025-46328NodeJS Driver for Snowflake has race condition when checking access to Easy Logging configuration filenpm · snowflake-sdk · fixed in 2.0.4
- CVE-2025-46653Formidable (aka node-formidable) 2.1.0 through 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable cnpm · formidable · fixed in 3.5.3, 2.1.3
- CVE-2025-43865React Router allows pre-render data spoofing on React-Router framework modenpm · react-router · fixed in 7.5.2
- CVE-2025-43864React Router allows a DoS via cache poisoning by forcing SPA modenpm · react-router · fixed in 7.5.2
- CVE-2025-43855tRPC 11 WebSocket DoS Vulnerabilitynpm · @trpc/server · fixed in 11.1.1
- CVE-2025-1520PostHog ClickHouse Table Functions SQL Injection Remote Code Execution Vulnerabilitynpm · @posthog/plugin-server
- CVE-2024-47829pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwritingnpm · pnpm · fixed in 10.0.0
- CVE-2025-32965Compromised xrpl.js versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2npm · xrpl · fixed in 4.2.5, 2.14.3
- CVE-2025-43954QMarkdown (aka quasar-ui-qmarkdown) before 2.0.5 allows XSS via headers even when when no-html is set.npm · @quasar/quasar-ui-qmarkdown · fixed in 2.0.5
- CVE-2025-32792ses's global contour bindings leak into Compartment lexical scopenpm · ses · fixed in 1.12.0
- CVE-2025-32442Fastify vulnerable to invalid content-type parsing, which could lead to validation bypassnpm · fastify · fixed in 5.3.2, 4.29.1, 5.8.5
- CVE-2025-32791Permission policy information leakage in Backstage permission systemnpm · @backstage/plugin-permission-backend · fixed in 0.6.0
- CVE-2025-32388SvelteKit allows XSS via tracked search_paramsnpm · @sveltejs/kit · fixed in 2.20.6
- CVE-2025-3573Versions of the package jquery-validation before 1.20.0 are vulnerable to Cross-site Scripting (XSS) in the showLabel() function, which may npm · jquery-validation · fixed in 1.20.0