Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-105866Payload: Unauthenticated account-lockout denial of servicenpm · payload · fixed in 3.90.0, 4.0.0-canary.34
- CVE-2026-105865Payload: Incomplete validation during the upload file lifecyclenpm · payload · fixed in 3.90.0, 4.0.0-canary.34
- CVE-2026-105864Payload: Cross-tenant create in @payloadcms/plugin-multi-tenantnpm · @payloadcms/plugin-multi-tenant · fixed in 3.90.0, 4.0.0-canary.34
- CVE-2026-105863Payload authentication token field handling issuenpm · payload · fixed in 3.90.0, 4.0.0-canary.34
- CVE-2026-105862Payload: Bypassed sanitization of user uploaded SVGsnpm · payload · fixed in 3.90.0, 4.0.0-canary.34
- CVE-2026-105861Payload external upload trust validation issuenpm · payload · fixed in 3.90.0, 4.0.0-canary.34
- CVE-2026-105860Payload: Tenant authorization bypass in Multi-Tenant Pluginnpm · @payloadcms/plugin-multi-tenant · fixed in 3.90.0, 4.0.0-canary.34
- CVE-2026-105859Payload: Unauthorized update to collection documentsnpm · payload · fixed in 3.90.0, 4.0.0-canary.34
- CVE-2026-105858Payload: Remote Code Execution through first-registernpm · payload · fixed in 3.90.0, 4.0.0-canary.34
- CVE-2026-105857Payload: RCE in Payload Form Buildernpm · @payloadcms/plugin-form-builder · fixed in 3.90.0, 4.0.0-canary.34
- CVE-2026-105856Payload: SQL injection in SQLite/Postgresnpm · @payloadcms/db-d1-sqlite, @payloadcms/db-postgres +2 · fixed in 3.90.0, 4.0.0-canary.34, 3.73.0
- CVE-2026-105855Payload: Field-level password update restrictions were not enforcednpm · payload · fixed in 3.90.0, 4.0.0-canary.34
- CVE-2026-105854Payload: ReDoS in Multipart Content-Type Validationnpm · payload · fixed in 3.90.0, 4.0.0-canary.34
- CVE-2026-105853Payload: Token refresh and password reset responses may expose restricted user fieldsnpm · payload · fixed in 3.90.0, 4.0.0-canary.34
- CVE-2026-105852Payload relationship-query authorization bypassnpm · payload · fixed in 3.90.0, 4.0.0-canary.34
- CVE-2026-105850Payload: Order confirmation validation issue in Payload Ecommercenpm · @payloadcms/plugin-ecommerce · fixed in 3.90.0, 4.0.0-canary.34
- CVE-2026-105849Payload: API key disclosure through ordinary document readsnpm · payload · fixed in 3.90.0, 4.0.0-canary.34
- CVE-2026-104850MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP servernpm · @modelcontextprotocol/client, @modelcontextprotocol/sdk · fixed in 2.2.0, 1.31.0
- CVE-2026-105848Payload: Insufficient Access Control in Stripe REST Proxynpm · @payloadcms/plugin-stripe · fixed in 3.90.0, 4.0.0-canary.34
- CVE-2026-105847Payload: Polymorphic join queries could disclose hidden fieldsnpm · payload · fixed in 3.90.0, 4.0.0-canary.34
- CVE-2026-105846Payload: Untrusted redirect URL parameter exploitnpm · @payloadcms/next, payload · fixed in 3.88.0, 4.0.0-canary.27
- CVE-2026-105845Payload: SQL Injection in SQLite and Postgresnpm · payload · fixed in 3.88.0, 4.0.0-canary.27
- CVE-2026-105844Payload: Prototype pollution in Payload Import Export pluginnpm · @payloadcms/plugin-import-export · fixed in 3.88.0, 4.0.0-canary.27
- CVE-2026-105806Payload: Improper access control for MCP API keysnpm · @payloadcms/plugin-mcp · fixed in 3.88.0
- CVE-2026-105805Payload: Sort queries could expose protected field informationnpm · payload · fixed in 3.88.0, 4.0.0-canary.27
- CVE-2026-105804Payload: Password hashes use insufficient PBKDF2 iterationsnpm · payload · fixed in 3.90.0, 4.0.0-canary.34
- CVE-2026-105800i18next-http-backend incomplete URL validation permits SSRFnpm · i18next-http-backend · fixed in 4.0.2
- CVE-2026-105799LangChain: RediSearch Filter Injection via Unescaped Tag/Text Valuesnpm · @langchain/redis · fixed in 1.1.1
- CVE-2026-104852GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`npm · @graphql-tools/utils · fixed in 12.0.1
- CVE-2026-105683Ghost: Path Traversal Vulnerability in Ghost ImageSize Servicenpm · ghost · fixed in 6.27.0