Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-103289Ghost 5.9.0 before 6.44.1 Authorization Bypass via Commentsnpm · ghost · fixed in 6.44.1
- CVE-2026-103288Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Likenpm · ghost · fixed in 6.44.1
- CVE-2026-103287Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhooknpm · ghost · fixed in 6.27.0
- CVE-2026-102992piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / envnpm · piscina · fixed in 5.3.2, 4.9.4, 6.0.0-rc.5
- CVE-2026-102990basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)npm · basic-ftp · fixed in 6.2.1
- CVE-2026-55177CloudTAK: Authenticated full-read SSRF in /api/esri* routes — user-controlled URL fetched with no IP-classification guardnpm · @tak-ps/cloudtak · fixed in 13.10.0
- CVE-2026-94545Satori-generated SVG has improper escapingnpm · satori · fixed in 0.33.5
- CVE-2026-102984Astro: Malformed port in the Host header can crash the Node adapternpm · @astrojs/node · fixed in 11.1.3
- CVE-2026-102983Astro: Netlify Image CDN allowlist bypass enables SSRFnpm · @astrojs/netlify · fixed in 8.2.4
- CVE-2026-102829simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detectionnpm · @simple-git/argv-parser · fixed in 2.0.1
- CVE-2026-102828simple-git unsafe-operation guard does not block trailer command configurationnpm · simple-git · fixed in 4.0.1
- CVE-2026-102827simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)npm · simple-git · fixed in 4.0.0
- CVE-2026-102826simple-git allows command execution through unblocked Git configuration includesnpm · simple-git · fixed in 4.0.0
- CVE-2026-102677Electron: Sandboxed preload code cache can be poisoned by a compromised renderernpm · electron · fixed in 42.10.0, 43.5.0, 44.0.0-beta.6
- CVE-2026-102676Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictionsnpm · electron · fixed in 41.10.6, 42.9.2, 43.4.1 and more
- CVE-2026-102675Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnablednpm · electron · fixed in 41.10.6, 42.9.2, 43.4.1 and more
- CVE-2026-102674Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictionsnpm · electron · fixed in 41.10.6, 42.9.2, 43.4.1 and more
- CVE-2026-102673Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTabnpm · electron · fixed in 41.10.4, 42.5.2, 43.0.0
- CVE-2026-97711Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodiesnpm · serialize-javascript · fixed in 7.1.2
- CVE-2026-102600Socket.IO: Prototype Pollution via Unsafe Client Session Lookupnpm · @socket.io/cluster-engine · fixed in 0.1.1
- CVE-2026-102422shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` tokennpm · shell-quote · fixed in 1.11.0
- CVE-2026-102414pbkdf2 rehashes long passwords on every iteration, enabling denial of servicenpm · pbkdf2 · fixed in 3.1.7
- CVE-2026-102281Nest: Remote process termination via a deeply nested microservice message patternnpm · @nestjs/microservices · fixed in 11.2.4, 12.0.2
- CVE-2026-102278brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustionnpm · brace-expansion · fixed in 5.0.11, 3.0.8, 2.1.6 and more
- CVE-2026-102277brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of servicenpm · brace-expansion · fixed in 5.0.12, 3.0.9, 2.1.7 and more
- CVE-2026-102276brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustionnpm · brace-expansion · fixed in 5.0.10, 3.0.7, 2.1.5 and more
- CVE-2026-101916@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorizednpm · @grpc/grpc-js · fixed in 1.13.6, 1.14.5
- CVE-2026-101915@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messagesnpm · @grpc/grpc-js · fixed in 1.13.6, 1.14.5
- CVE-2026-101914@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matchesnpm · @grpc/grpc-js-xds · fixed in 1.13.1, 1.14.1
- CVE-2026-101913ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hostsnpm · ip-address · fixed in 10.5.1