Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-92000adm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed Sizenpm · adm-zip · fixed in 0.6.1
- CVE-2026-61568@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transportnpm · @zereight/mcp-gitlab · fixed in 2.1.30
- CVE-2026-57442MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nestednpm · @bitbonsai/mcpvault · fixed in 0.11.5
- CVE-2026-57441MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalencenpm · @bitbonsai/mcpvault · fixed in 0.11.4
- CVE-2026-58483mcp-searxng: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`npm · mcp-searxng · fixed in 1.7.1
- CVE-2026-58485mcp-searxng: DNS-resolved Private Hostname SSRF in `web_url_read`npm · mcp-searxng · fixed in 1.7.1
- CVE-2026-54688mcp-searxng: SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off)npm · mcp-searxng · fixed in 1.2.1
- CVE-2026-54689mcp-searxng hardened-mode SSRF bypasses permit internal URL accessnpm · mcp-searxng · fixed in 1.2.1
- CVE-2026-58201Lokka: Azure Resource Manager URL path validation issuenpm · @merill/lokka · fixed in 2.1.2
- CVE-2026-59160Yeger: Unauthenticated Network-Exposed Turborepo Task Execution via /api/runnpm · @yeger/turbo-graph · fixed in 2.8.12
- CVE-2026-54561MCP Memory Keeper: Arbitrary local file read in mcp-memory-keeper context_import via unvalidated filePathnpm · mcp-memory-keeper · fixed in 0.13.0
- CVE-2026-58200@jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signingnpm · @jhb.software/payload-cloudinary-plugin · fixed in 0.4.0
- CVE-2026-59965@jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omissionnpm · @jhb.software/payload-alt-text-plugin · fixed in 0.8.0
- CVE-2026-55591Signal K Server: Server-Side Request Forgery via Remote Connection Endpointsnpm · signalk-server · fixed in 2.28.0
- CVE-2026-59973mcp-from-openapi: Bypass of OpenAPI external $ref SSRF fix in latest FrontMCP and mcp-from-openapinpm · @frontmcp/adapters, frontmcp +1 · fixed in 1.5.0, 2.5.0
- CVE-2026-55178GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile datanpm · @geolens/sdk · fixed in 1.2.3
- CVE-2026-55617Hydro: Insufficient session expiration when recreating sessionsnpm · hydrooj · fixed in 5.0.2
- CVE-2026-55650Outerbase Studio: Stored XSS in Text Widget Leads to Authentication Token Exposurenpm · @outerbase/studio
- CVE-2026-53957Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpointnpm · @contentful/mcp-server, @contentful/mcp-tools · fixed in 1.7.19, 0.4.5
- CVE-2026-86818fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronizationnpm · fast-uri · fixed in 4.1.5
- CVE-2026-86472fast-uri vulnerable to inconsistent host case normalization via percent-encoded octetsnpm · fast-uri · fixed in 2.4.7, 3.1.8, 4.1.5
- CVE-2026-57140PraisonAI AgentOS exposes unauthenticated agent listing and invocationnpm · praisonai · fixed in 1.7.2
- CVE-2026-57139PraisonAI MCPServer exposes unauthenticated HTTP tools/callnpm · praisonai · fixed in 1.7.2
- CVE-2026-57133PraisonAI utility shell safe-command wrapper allowlist bypass via shell chainingnpm · praisonai · fixed in 1.7.2
- CVE-2026-57135PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clientsnpm · praisonai · fixed in 1.7.2
- CVE-2026-57134PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validationnpm · praisonai · fixed in 1.7.2
- CVE-2026-57138PraisonAI codeMode sandbox escape via Function constructornpm · praisonai · fixed in 1.7.2
- CVE-2026-57136PraisonAI SandboxExecutor allowedCommands bypass via shell chainingnpm · praisonai · fixed in 1.7.2
- CVE-2026-57137PraisonAI AgentLoop onToolCall approval runs after tool executionnpm · praisonai · fixed in 1.7.2
- CVE-2026-57141PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Toolnpm · praisonai · fixed in 1.7.2