Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-63395isomorphic-git: Arbitrary file write outside the working tree via a directory symlink during checkout (potential RCE)npm · isomorphic-git · fixed in 1.38.6
- CVE-2026-63475isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)npm · isomorphic-git · fixed in 1.38.6
- CVE-2026-63478isomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkoutnpm · isomorphic-git · fixed in 1.38.6
- CVE-2026-63501ag-psd: Uncontrolled Memory Allocation in PSD Layer Decoding (totalMemoryLimit bypass)npm · ag-psd · fixed in 31.0.1
- CVE-2026-44267Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitternpm · @enspirit/elo · fixed in 1.0.1
- CVE-2026-44266Elo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labelsnpm · @enspirit/elo · fixed in 1.0.1
- CVE-2026-44265Elo: Code injection in Elo backends via unvalidated emission of programmatic AST fieldsnpm · @enspirit/elo · fixed in 1.0.1
- CVE-2026-121426Nodemailer 3.0.0 before 10.1.4 Recipient Domain Confusion via addressparsernpm · nodemailer · fixed in 10.1.4
- GHSA-4XM8-RG9H-JHQ2Signal K resources API path traversal can disclose the JWT signing secret and enable remote code executionnpm · @signalk/resources-provider, signalk-server · fixed in 1.5.3, 2.34.0
- CVE-2026-62300Filecoin Pin: Unbounded DAG pinning can exhaust filecoin-pin server resourcesnpm · filecoin-pin · fixed in 1.1.1
- CVE-2026-62264PDF Reader MCP: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEYnpm · @sylphx/pdf-reader-mcp · fixed in 3.0.1
- CVE-2026-119978Flowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStorenpm · flowise, flowise-components · fixed in 3.1.3
- CVE-2026-61789DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validationnpm · @bytebase/dbhub · fixed in 0.22.6
- CVE-2026-119713Paperclip 2026.403.0 before 2026.416.0 RCE via Execution Workspace Cleanup Commandsnpm · @paperclipai/server · fixed in 2026.416.0
- CVE-2026-119282Nx: OS command injection via nx.json plugin options in @nx/maven and @nx/gradlenpm · @nx/gradle, @nx/maven · fixed in 22.7.9, 23.1.2
- CVE-2026-119202@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of servicenpm · @hapi/content, content · fixed in 6.0.3
- CVE-2026-119201Nuxt dev server exposes generated appSecret through Vite file servingnpm · @nuxt/vite-builder · fixed in 4.6.3
- CVE-2026-119200Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routesnpm · @nuxt/nitro-server, nuxt · fixed in 4.6.3
- CVE-2026-119199Nuxt dev server exposes private runtime config through the Nitro dev bundlenpm · @nuxt/vite-builder · fixed in 4.6.3
- CVE-2026-119198Nuxt dev server arbitrary file read through client error reportsnpm · @nuxt/vite-builder · fixed in 4.6.3
- CVE-2026-119190Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13npm · node-forge · fixed in 1.4.1
- CVE-2026-119188Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake messagenpm · node-forge · fixed in 1.4.1
- CVE-2026-119187Forge: Denial of service in TLS record processing via call stack exhaustionnpm · node-forge · fixed in 1.4.1
- CVE-2026-119186Forge: AES-GCM authentication bypass via unvalidated tagLength optionnpm · node-forge · fixed in 1.4.1
- CVE-2026-118782Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration countnpm · node-forge · fixed in 1.4.1
- CVE-2026-118781Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)npm · node-forge · fixed in 1.4.1
- CVE-2026-118780Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA storenpm · node-forge · fixed in 1.4.1
- CVE-2026-118779Forge: Regular expression denial of service in PEM decoding (pem.decode)npm · node-forge · fixed in 1.4.1
- CVE-2026-118778Forge: TLS client crash when the server sends no certificatenpm · node-forge · fixed in 1.4.1
- CVE-2026-118777Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookienpm · node-forge · fixed in 1.4.1