Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-76228Renovate before 42.68.5 Remote Code Execution via Gradle Wrappernpm · renovate · fixed in 42.68.5
- CVE-2026-76227Renovate 42.68.1 before 42.96.3 and 43.0.0 before 43.4.4 Environment Variable Exposurenpm · renovate · fixed in 42.96.3, 43.4.4
- CVE-2026-76226Renovate 43.65.0 before 43.102.11 Remote Code Execution via lockFileMaintenancenpm · renovate · fixed in 43.102.11
- CVE-2024-58376Renovate 37.158.0 before 37.199.0 Command Injection via helmv3npm · renovate · fixed in 37.199.0
- CVE-2020-37267Renovate 19.180.0 before 23.25.1 Token Leakage via Logsnpm · renovate · fixed in 23.25.1
- CVE-2019-25766Renovate before 19.38.7 Credential Exposure via Go Modulesnpm · renovate · fixed in 19.38.7
- CVE-2026-16732fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-countnpm · fastify · fixed in 5.12.1
- CVE-2026-18504fastify vulnerable to schema validation bypass via root primitive coercion mismatchnpm · fastify · fixed in 5.12.1
- CVE-2026-47721FUXA: Scheduler API missing admin check enables operator-to-admin escalation via scheduled device actionsnpm · fuxa-server
- CVE-2026-47719FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response readingnpm · fuxa-server
- CVE-2026-47720FUXA: SQL injection in TDengine DAQ connector via backslash bypass of escapeTdStringnpm · fuxa-server
- CVE-2026-50143Actor MCP path authority injection leaks Apify tokennpm · @apify/actors-mcp-server · fixed in 0.10.11
- CVE-2026-63640MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variablesnpm · magicmirror · fixed in 2.37.0
- CVE-2026-63642MagicMirror newsfeed Socket.IO notification allows blind server-side request forgerynpm · magicmirror · fixed in 2.37.0
- CVE-2026-63643MagicMirror: ssrf calendar .jsnpm · magicmirror · fixed in 2.37.0
- CVE-2026-63641MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actionsnpm · magicmirror · fixed in 2.37.0
- CVE-2026-75915CodeWhale before 0.8.64 Environment Variable Leak via js_executionnpm · codewhale, deepseek-tui · fixed in 0.8.64, 0.8.41
- CVE-2026-75914CodeWhale before 0.8.64 Path Traversal via image_analyze symlinknpm · codewhale, deepseek-tui · fixed in 0.8.64, 0.8.41
- CVE-2026-75913CodeWhale before 0.8.64 Argument Injection via git_shownpm · codewhale, deepseek-tui · fixed in 0.8.64, 0.8.41
- CVE-2026-75912CodeWhale before 0.8.64 Argument Injection via git_blamenpm · codewhale, deepseek-tui · fixed in 0.8.64, 0.8.41
- CVE-2026-75911CodeWhale before 0.8.64 Remote Code Execution via allow_shellnpm · codewhale, deepseek-tui · fixed in 0.8.64, 0.8.41
- CVE-2026-75859CodeWhale before 0.8.64 Arbitrary File Read via instructionsnpm · codewhale, deepseek-tui · fixed in 0.8.64, 0.8.41
- CVE-2026-75858CodeWhale rlm_eval before 0.8.64 Remote Code Executionnpm · codewhale, deepseek-tui · fixed in 0.8.64, 0.8.41
- CVE-2026-75857CodeWhale before 0.8.64 Privilege Escalation via exec_shell_interactnpm · codewhale, deepseek-tui · fixed in 0.8.64, 0.8.41
- CVE-2026-75856CodeWhale before 0.8.64 SSRF Bypass via DNS Pinning TOCTOUnpm · codewhale, deepseek-tui · fixed in 0.8.64, 0.8.41
- CVE-2026-71539n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Executionnpm · n8n · fixed in 1.123.64, 2.30.1, 2.29.8
- CVE-2026-59940Seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserializationnpm · seroval · fixed in 1.5.3
- CVE-2026-73426Trix: Stored XSS vulnerability through serialized attributesnpm · trix · fixed in 2.1.17
- CVE-2026-75838DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hooknpm · dompurify · fixed in 3.4.13
- CVE-2026-69146MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-authnpm · mlflow · fixed in 3.15.0