Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-40345deepmerge-ts: Stack exhaustion when merging recursive object graphsnpm · deepmerge-ts · fixed in 8.0.0
- CVE-2026-61704link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897npm · link-preview-js · fixed in 4.0.4
- CVE-2026-63123Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media rootnpm · @tinacms/cli · fixed in 2.5.2
- CVE-2026-59992Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)npm · next-tinacms-azure, next-tinacms-cloudinary +2 · fixed in 14.0.4, 26.0.4, 23.0.4
- CVE-2026-69222LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the processnpm · liquidjs · fixed in 10.27.2
- CVE-2026-61556LiquidJS: An infinite loop vulnerability in `strip_html` filternpm · liquidjs · fixed in 10.27.1
- CVE-2026-63188logto-tunnel serves files outside --experience-path via path traversalnpm · @logto/tunnel · fixed in 0.3.9
- CVE-2026-55086Etherpad: Import/export use Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwritenpm · ep_etherpad-lite · fixed in 3.1.0
- CVE-2026-55090Etherpad: Stored XSS in HTML export via unescaped attribute-pool valuesnpm · ep_etherpad-lite · fixed in 3.3.0
- CVE-2026-55088Etherpad: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author tokennpm · ep_etherpad-lite · fixed in 3.1.0
- CVE-2026-55087Etherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect)npm · ep_etherpad-lite · fixed in 3.1.0
- CVE-2026-62680Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $refnpm · orval · fixed in 8.22.0
- CVE-2026-62682Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)npm · orval · fixed in 8.21.0
- CVE-2026-72717Orval: Import-time RCE via schema default -> zod module-level template literalnpm · orval · fixed in 8.21.0
- CVE-2026-71867Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generatornpm · orval · fixed in 8.21.0
- CVE-2026-71868Orval: Import-time RCE via enum-typed default -> zod module-level template literalnpm · orval · fixed in 8.21.0
- CVE-2026-71865Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod clinpm · orval · fixed in 8.21.0
- CVE-2026-71869Orval: Import-time RCE via array-items default -> zod module-level template literalnpm · orval · fixed in 8.21.0
- CVE-2026-71864Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod clientnpm · orval · fixed in 8.21.0
- CVE-2026-71871Orval: Import-time RCE via header-parameter default -> zod module-level template literalnpm · orval · fixed in 8.21.0
- CVE-2026-72716Orval: Import-time RCE via query-parameter default -> zod module-level template literalnpm · orval · fixed in 8.21.0
- CVE-2026-62681Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)npm · orval · fixed in 8.21.0
- CVE-2026-71866Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod clientnpm · orval · fixed in 8.21.0
- CVE-2026-49253electerm: Path Traversal in Zmodem and Trzsz Download Filename Handlingnpm · electerm · fixed in 3.11.11
- CVE-2026-49255electerm: Command Injection in File System Operations (rmrf, mv, cp)npm · electerm · fixed in 3.11.11
- CVE-2026-76233Renovate 39.53.0 before 40.33.0 Command Injection via gleam managernpm · renovate · fixed in 40.33.0
- CVE-2026-76232Renovate 31.51.0 before 40.33.0 Command Injection via helmv3npm · renovate · fixed in 40.33.0
- CVE-2026-76231Renovate 32.135.0 before 40.33.0 Command Injection via hermitnpm · renovate · fixed in 40.33.0
- CVE-2026-76230Renovate 35.63.0 before 40.33.0 Command Injection via npmnpm · renovate · fixed in 40.33.0
- CVE-2026-76229Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomizenpm · renovate · fixed in 40.33.0