Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-61782@rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadatanpm · @rsdoctor/rspack-plugin · fixed in 1.5.16
- CVE-2026-61742DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL executionnpm · @bytebase/dbhub · fixed in 0.22.5
- CVE-2026-56744`@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction (can redirect payments when using remote storage)npm · @bsv/wallet-toolbox, @bsv/wallet-toolbox-client +1 · fixed in 2.4.0
- CVE-2026-77394OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widgetnpm · @openc3/vue-common · fixed in 7.3.0
- CVE-2026-61834scim-patch: Mutation of Inherited Built-in Method Objectsnpm · scim-patch · fixed in 0.9.2
- CVE-2026-59167SunEditor: Critical XSS vulnerability - sanitizer bypassnpm · suneditor · fixed in 2.47.11
- CVE-2026-61685ReactPress has SQL injection via dynamic column names in TypeORM query buildersnpm · @fecommunity/reactpress · fixed in 3.7.0
- CVE-2026-77426Unleash: Missing await on permission check + cross-project IDOR in admin APInpm · unleash-server · fixed in 8.0.3
- CVE-2026-77425Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit lognpm · unleash-server · fixed in 8.0.3
- CVE-2026-76910Unleash: Clone-feature lets a user copy a feature from a project they cannot readnpm · unleash-server · fixed in 8.0.3
- CVE-2026-76909Unleash: CR-approval email renders user-controlled raw HTMLnpm · unleash-server · fixed in 8.0.3
- CVE-2026-62985request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js processnpm · request-filtering-agent · fixed in 3.2.1
- CVE-2026-63628mppx: Gas Draining with access listnpm · mppx · fixed in 0.8.2
- CVE-2026-63627mppx: Gas Draining with paddingnpm · mppx · fixed in 0.8.2
- CVE-2026-566829Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Headernpm · 9router · fixed in 0.5.8
- CVE-2026-566819Router: Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Headernpm · 9router · fixed in 0.5.8
- CVE-2026-75510Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: schemenpm · @novu/js · fixed in 3.18.0
- CVE-2026-61647@roomi-fields/notebooklm-mcp has path traversal in vault.batch tool that allows arbitrary file write outside intended vault directorynpm · @roomi-fields/notebooklm-mcp · fixed in 2.0.3
- CVE-2026-58272Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)npm · @sync-in/server · fixed in 2.4.1
- CVE-2026-58270Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`npm · @sync-in/server · fixed in 2.4.0
- CVE-2026-58269Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`npm · @sync-in/server · fixed in 2.4.0
- CVE-2026-58271@sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`npm · @sync-in/server · fixed in 2.4.0
- CVE-2026-61612@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509npm · @aborruso/ckan-mcp-server · fixed in 0.4.108
- CVE-2026-63116deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writesnpm · @deepstream/server · fixed in 10.1.1
- CVE-2026-93981hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Stringsnpm · hono · fixed in 4.13.7
- CVE-2026-92708devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffersnpm · devalue · fixed in 5.9.3
- CVE-2026-93749source-map-js through 1.2.1 Event Loop Denial of Servicenpm · source-map-js · fixed in 1.2.2
- CVE-2026-93748http-cache-semantics through 4.2.0 Cross-User Cache Disclosure via max-stalenpm · http-cache-semantics
- CVE-2026-91127File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderernpm · @file-viewer/doc, msdoc-viewer · fixed in 2.3.1, 0.2.2
- CVE-2026-84992md-editor-v3: XSS via fenced-code language rendering bypassnpm · md-editor-v3 · fixed in 6.5.4