Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-105682Ghost: Server-Side Request Forgery in Webhook Triggernpm · ghost · fixed in 6.27.0
- CVE-2026-105681Ghost: Authorization Bypass in Comments Featurenpm · ghost · fixed in 6.44.1
- CVE-2026-105680Ghost: Authorization Issue Allowed Author Role to Delete any Postnpm · ghost · fixed in 6.60.0
- CVE-2026-105679Ghost: Stored XSS via File Uploads on Local Storagenpm · ghost · fixed in 6.64.0
- CVE-2026-105678Ghost: Editors Could Promote Staff Users to Their Own Rolenpm · ghost · fixed in 6.64.0
- CVE-2026-105677Ghost: Remote Code Execution via Theme Translation Filesnpm · ghost · fixed in 6.64.0
- CVE-2026-105676Ghost: Path Traversal via Locale Settingnpm · ghost · fixed in 6.64.0
- CVE-2026-105675Ghost: Invite Token Disclosure in Ghost Admin APInpm · ghost · fixed in 6.64.0
- CVE-2026-105652Ghost: Password Hash Ordering Disclosure in Ghost Admin APInpm · ghost · fixed in 6.64.0
- CVE-2026-105651Ghost: Stored XSS via Bookmark Card Imagesnpm · ghost · fixed in 6.64.0
- CVE-2026-105650Ghost: Stored XSS via oEmbed Photo Responsesnpm · ghost · fixed in 6.64.0
- CVE-2026-105649Ghost: Stored XSS via SVG Uploads Bypassing Sanitizationnpm · ghost · fixed in 6.65.0
- CVE-2026-105648Ghost: Private IP Filtering Bypass via IPv6 Transition Addressesnpm · ghost · fixed in 6.65.0
- CVE-2026-105647Ghost: Server-Side Request Forgery in Bookmark Fetchingnpm · ghost · fixed in 6.65.0
- CVE-2026-105646Ghost: Regular Expression Denial of Service in Content Importnpm · ghost · fixed in 6.67.0
- CVE-2026-105645Ghost: Regular Expression Denial of Service in External Media Inlinernpm · ghost · fixed in 6.67.0
- CVE-2026-105644Ghost: Stored XSS via SVG Files in Content Importsnpm · ghost · fixed in 6.67.0
- CVE-2026-105643Ghost: Stored XSS via Embed Card Previewsnpm · ghost · fixed in 6.67.0
- CVE-2026-105642Ghost: Remote Code Execution via Bookmark Card Imagesnpm · ghost · fixed in 6.67.0
- CVE-2026-102282adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalationnpm · adm-zip · fixed in 0.6.1
- CVE-2026-104891mppx-condition-gate: Free-access path grants on a self-declared wallet without proving controlnpm · @insumermodel/mppx-condition-gate, @insumermodel/mppx-token-gate · fixed in 3.0.0, 1.0.4
- CVE-2026-103918@orpc/zod: Prototype injection in smart coercionnpm · @orpc/zod · fixed in 1.14.10
- CVE-2026-104872Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attributenpm · @opentelemetry/instrumentation-cassandra-driver, @opentelemetry/instrumentation-knex +6 · fixed in 0.66.0, 0.65.0, 0.67.0 and more
- CVE-2026-104871Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windowsnpm · @angular/ssr · fixed in 22.1.7, 21.2.23, 20.3.36
- CVE-2026-104861probe-image-size: Quadratic-time Denial of Service in the SVG Parsernpm · probe-image-size · fixed in 7.4.0
- CVE-2026-104859Nx: OS command injection in the @nx/docker release pipelinenpm · @nx/docker · fixed in 22.7.8, 23.1.1
- CVE-2026-104854Nx daemon and plugin worker sockets are accessible to other local usersnpm · nx · fixed in 22.7.9, 23.1.2
- CVE-2026-104853Nx: Path traversal in nx migrate package-migrations extractionnpm · nx · fixed in 22.7.10, 23.2.1
- CVE-2026-104849Tinypool: Prototype Pollution Gadget to RCE in run() optionsnpm · tinypool · fixed in 2.1.2
- CVE-2026-104848Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Executionnpm · tinypool · fixed in 2.1.1