Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-104847ProseMirror: XSS vulnerability in prosemirror-view's paste handlingnpm · prosemirror-view · fixed in 1.42.3
- CVE-2026-104846Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)npm · seroval · fixed in 1.6.2
- CVE-2026-104845Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserializationnpm · seroval · fixed in 1.6.3
- CVE-2026-104844PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustionnpm · postcss-selector-parser · fixed in 7.1.6, 6.1.5
- CVE-2026-94484Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of servicenpm · next · fixed in 16.3.8, 15.5.27
- CVE-2026-94485Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypassnpm · next · fixed in 16.3.8
- CVE-2026-94483Next.js: Server-Side Request Forgery in Image Optimizationnpm · next · fixed in 16.3.8
- CVE-2026-94543Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applicationsnpm · next · fixed in 15.5.27, 16.3.8
- CVE-2026-94544Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pagesnpm · next · fixed in 16.3.8
- CVE-2026-94486Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpointnpm · next · fixed in 16.3.8
- CVE-2026-104418Ghost from 6.10.3 before 6.64.0 RCE via Theme Translation Filesnpm · ghost · fixed in 6.64.0
- CVE-2026-104417Ghost 1.20.0 before 6.64.0 Path Traversal via Locale Settingnpm · ghost · fixed in 6.64.0
- CVE-2026-104416Ghost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin APInpm · ghost · fixed in 6.64.0
- CVE-2026-104415Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin APInpm · ghost · fixed in 6.64.0
- CVE-2026-104414Ghost from 2.5.0 before 6.64.0 Stored XSS via oEmbed Photo Responsesnpm · ghost · fixed in 6.64.0
- CVE-2026-104413Ghost 5.94.0 before 6.64.0 Stored XSS via Bookmark Card Imagesnpm · ghost · fixed in 6.64.0
- CVE-2026-104412Ghost 0.5.0 before 6.64.0 Privilege Escalation via Staff Role Assignmentnpm · ghost · fixed in 6.64.0
- CVE-2026-104411Ghost 6.22.1 before 6.64.0 Stored XSS via Local Storage File Uploadsnpm · ghost · fixed in 6.64.0
- CVE-2026-96780figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small widthnpm · figlet · fixed in 1.11.3
- CVE-2026-104183stream-json: Prototype pollution: Assembler writes this.current[this.key] on plain objectsnpm · stream-json · fixed in 3.6.0
- CVE-2026-104182stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunknpm · stream-json · fixed in 3.6.0
- CVE-2026-103923KaTeX: Existing prototype pollution can bypass trust restrictionsnpm · katex · fixed in 0.18.2
- CVE-2026-103922Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy pathnpm · @capacitor/android, @capacitor/ios · fixed in 6.2.2, 7.6.9, 8.5.1 and more
- CVE-2026-103921GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executornpm · @graphql-tools/executor-legacy-ws · fixed in 1.1.35
- GHSA-MCM9-63F2-9J32devalue: Repeated primitive strings cause quadratic expansion in unevalnpm · devalue · fixed in 5.9.3
- GHSA-WF3X-273G-MVXVdevalue: Sparse arrays emitted by uneval cause eager allocation when evaluatednpm · devalue · fixed in 5.9.3
- GHSA-R9W8-H9R3-54W4devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validationnpm · devalue · fixed in 5.9.3
- GHSA-4Q55-J62X-FR9Hdevalue: Malformed null-prototype object keys bypass proto rejection via property-key coercionnpm · devalue · fixed in 5.9.3
- CVE-2026-103004next.js cache leak on warm `use cache` handlers accessing root paramnpm · next · fixed in 16.3.8
- CVE-2026-103290Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSizenpm · ghost · fixed in 6.27.0