Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-54511@logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keysnpm · @logtape/syslog · fixed in 2.1.5, 2.0.14, 1.3.11
- CVE-2026-55609sublinear-time-solver: Arbitrary file write in consciousness-explorer / sublinear-time-solver MCP export_statenpm · consciousness-explorer, sublinear-time-solver · fixed in 1.1.2, 1.6.0
- CVE-2026-55663mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)npm · mediasoup · fixed in 3.20.6
- CVE-2026-55557browse-mcp: Arbitrary file write via unconfined download and state pathsnpm · browse-mcp · fixed in 0.8.2
- CVE-2026-55553urllib: Cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakagenpm · urllib · fixed in 4.9.1, 2.44.1
- CVE-2026-76845adm-zip 0.5.9 through 0.6.0 Arbitrary File Overwrite via Symlink Following on Extractionnpm · adm-zip
- CVE-2026-76844zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Writenpm · webpack-dev-middleware · fixed in 8.3.0, 7.4.6
- CVE-2026-76172fast-uri vulnerable to host confusion via percent-encoded scheme normalizationnpm · fast-uri · fixed in 2.4.5, 3.1.6, 4.1.3
- CVE-2026-75975fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizationnpm · fast-uri · fixed in 2.4.5, 3.1.6, 4.1.3
- CVE-2026-75899fast-uri vulnerable to server-side request forgery via repeated hostname percent-decodingnpm · fast-uri · fixed in 2.4.5, 3.1.6, 4.1.3
- CVE-2026-75931fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative referencesnpm · fast-uri · fixed in 2.4.5, 3.1.6, 4.1.3
- CVE-2026-78209exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Valuesnpm · exceljs
- CVE-2026-78208exceljs through 4.4.0 Path Traversal via Unvalidated addImage filenamenpm · exceljs
- CVE-2026-78207exceljs through 4.4.0 Prototype Pollution via deepMerge Reached From Note Serializationnpm · exceljs
- CVE-2026-78206exceljs through 4.4.0 Uncontrolled Resource Consumption via Unbounded xlsx Decompressionnpm · exceljs
- CVE-2026-53509@aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)npm · @aborruso/ckan-mcp-server · fixed in 0.4.106
- CVE-2026-77415JSONata: Arbitrary Code Execution via crafted JSONata expressionsnpm · jsonata · fixed in 2.2.1, 1.8.8
- CVE-2026-77414JSONata: Arbitrary Code Execution via crafted JSONata expressionsnpm · jsonata · fixed in 2.2.1, 1.8.8
- CVE-2026-77413JSONata: Arbitrary Code Execution via crafted JSONata expressionsnpm · jsonata · fixed in 1.8.8, 2.2.0
- CVE-2026-63421Keystone: `graphql.maxTake` bypass with negative `take`npm · @keystone-6/core · fixed in 6.5.3
- CVE-2026-61824Defuddle: XSS via unescaped attribute interpolation in site extractorsnpm · defuddle · fixed in 0.19.1
- CVE-2026-50290@asymmetric-effort/specifyjs: CSS expression sanitization is bypassable in renderToStringnpm · @asymmetric-effort/specifyjs · fixed in 0.2.136
- CVE-2026-50288@asymmetric-effort/specifyjs: URL parse failure silently allows requestnpm · @asymmetric-effort/specifyjs · fixed in 0.2.136
- CVE-2026-63466Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted usernamenpm · unleash-server · fixed in 8.0.3
- CVE-2026-63462Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatternpm · unleash-server · fixed in 7.5.2, 7.6.5, 8.0.2
- CVE-2026-63004Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headersnpm · unleash-server · fixed in 7.5.2, 7.6.5, 8.0.2
- CVE-2026-74866@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and namenpm · @fastify/busboy · fixed in 3.2.2
- CVE-2026-728609router Server-Side Request Forgery via /api/provider-nodes/validate Because the IPv4-Mapped IPv6 Denylist Check Is Unreachablenpm · 9router
- CVE-2026-68921DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)npm · @dicebear/core, @dicebear/initials · fixed in 9.4.3
- CVE-2026-65842Plate: SSRF with response disclosure in DOCX image embeddingnpm · @platejs/docx-io · fixed in 53.3.2