Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-82860@hulumi/policies before 1.3.2 Admin Policy Bypassnpm · @hulumi/policies · fixed in 1.3.2
- CVE-2026-82858@hulumi/drift before 1.3.2 Unsafe Execute Plan Acceptancenpm · @hulumi/drift · fixed in 1.3.2
- CVE-2026-82856@hulumi/policies before 1.3.2 OIDC Trust Policy Bypassnpm · @hulumi/policies · fixed in 1.3.2
- CVE-2026-82855@hulumi/policies before 1.3.2 Evidence Validation Bypassnpm · @hulumi/policies · fixed in 1.3.2
- CVE-2026-82854Nodemailer before 8.0.4 SMTP Command Injection via envelope.sizenpm · nodemailer · fixed in 8.0.4
- CVE-2026-82853Nodemailer before 8.0.5 SMTP Command Injection via CRLFnpm · nodemailer · fixed in 8.0.5
- CVE-2026-82662Nodemailer before 8.0.8 TLS Certificate Validation Bypassnpm · nodemailer · fixed in 8.0.8
- CVE-2026-82661Nodemailer CRLF Injection via List-* Header Commentsnpm · nodemailer · fixed in 8.0.9
- CVE-2026-82660Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccessnpm · nodemailer · fixed in 8.0.9
- CVE-2026-82659nodemailer before 9.0.1 File Read and SSRF via raw optionnpm · nodemailer · fixed in 9.0.1
- CVE-2024-58379nodemailer before 6.9.9 ReDoS via attachDataUrls parameternpm · nodemailer · fixed in 6.9.9
- CVE-2026-82562qs.parse does not enforce arrayLimit on comma groups under bracket-push keys when throwOnLimitExceeded is set (incomplete fix for CVE-2026-2391)npm · qs · fixed in 6.16.0
- CVE-2026-82417qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer propertynpm · qs · fixed in 6.16.0
- CVE-2026-55855MariaDB Connector/Node.js: Possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsetsnpm · mariadb · fixed in 3.2.4, 3.3.4, 3.4.6 and more
- CVE-2026-55854MariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials in mariadbnpm · mariadb · fixed in 3.2.4, 3.3.3, 3.4.6 and more
- CVE-2026-82333multer vulnerable to Denial of Service via oversized array index in field namesnpm · multer · fixed in 2.3.0
- CVE-2026-77078multer vulnerable to Denial of Service via crafted multipart field namesnpm · multer · fixed in 2.3.0
- CVE-2026-77063multer vulnerable to file size limit bypass via async fileFilter race conditionnpm · multer · fixed in 2.3.0
- CVE-2026-77037multer vulnerable to Denial of Service via file descriptor leak on aborted uploadsnpm · multer · fixed in 2.3.0
- CVE-2026-55215MariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: true`npm · mariadb · fixed in 3.2.4, 3.3.3, 3.4.6 and more
- CVE-2026-15603morgan vulnerable to Log Forging via unescaped Unicode line separatorsnpm · morgan · fixed in 1.12.0
- CVE-2026-82261SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserializationnpm · @sveltejs/kit · fixed in 2.52.2
- CVE-2026-82260SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserializationnpm · @sveltejs/kit · fixed in 2.52.2
- CVE-2026-82259SvelteKit 2.49.0 before 2.53.3 Denial of Service via formnpm · @sveltejs/kit · fixed in 2.53.3
- CVE-2026-82258SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batchnpm · @sveltejs/kit · fixed in 2.60.1
- CVE-2026-82257SvelteKit before 2.69.1 Prototype Pollution via File Inputnpm · @sveltejs/kit · fixed in 2.69.1
- CVE-2026-82256SvelteKit before 2.69.1 Denial of Service via Remote Formnpm · @sveltejs/kit · fixed in 2.69.1
- CVE-2026-54732libreoffice-convert: path traversal / arbitrary file writenpm · libreoffice-convert · fixed in 1.8.2
- CVE-2026-54687n8n-nodes-sqlite3: Path traversal via user-controlled database file path (db_path parameter)npm · n8n-nodes-sqlite3 · fixed in 1.0.0
- CVE-2026-54606SunEditor: DOM XSS in SunEditor Embed Plugin via External Script Element After Iframe Embednpm · suneditor · fixed in 3.1.4