Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-69148MLflow: CreateModelVersion source validation does not check READ permission on referenced run_idnpm · mlflow · fixed in 3.15.0
- CVE-2026-566779Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpointnpm · 9router
- CVE-2026-47683vm2: bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLikenpm · vm2 · fixed in 3.11.6
- CVE-2026-47686vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCEnpm · vm2 · fixed in 3.11.6
- CVE-2026-47698vm2: Sandbox Breakout Using Dangerous Host Proto Mutatorsnpm · vm2 · fixed in 3.11.6
- CVE-2026-54356Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`npm · @budibase/server
- CVE-2026-35219Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklistnpm · @budibase/server · fixed in 3.41.3
- CVE-2026-73410Budibase: SSRF via DNS rebinding in the REST datasource integrationnpm · @budibase/server
- CVE-2026-64657Budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQLnpm · budibase · fixed in 3.39.19
- CVE-2026-71553ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoSnpm · apostrophe · fixed in 4.32.1
- CVE-2026-63667ApostropheCMS: Arbitrary file read via import-export attachment-name path traversalnpm · @apostrophecms/import-export · fixed in 3.6.2
- CVE-2026-63670ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus closenpm · sanitize-html · fixed in 2.17.6
- CVE-2026-63669ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtreenpm · apostrophe · fixed in 4.32.0
- CVE-2026-73424Astro: Unauthenticated path override in the @astrojs/vercel ISR functionnpm · @astrojs/vercel · fixed in 11.0.3
- CVE-2026-73646PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosurenpm · postcss · fixed in 8.5.18
- CVE-2026-19693extract-zip arbitrary file write outside the destination directory via a symlink at the final path componentnpm · extract-zip
- CVE-2026-50029js-toml has silent type confusion via falsy-primitive duplicate-key bypassnpm · js-toml · fixed in 1.1.2
- CVE-2026-73846CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoningnpm · @aborruso/ckan-mcp-server · fixed in 0.4.112
- CVE-2026-73845CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)npm · @aborruso/ckan-mcp-server · fixed in 0.4.112
- CVE-2026-73844CKAN MCP Server: Information disclosure via verbose error reflectionnpm · @aborruso/ckan-mcp-server · fixed in 0.4.112
- CVE-2026-72859Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URLnpm · @budibase/server
- CVE-2026-73305Budibase: Privilege escalation via public role assignment API missing app-level authorizationnpm · @budibase/server
- CVE-2026-73304Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Usersnpm · @budibase/server · fixed in 3.39.25
- CVE-2026-73408Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connectornpm · @budibase/server
- CVE-2026-73302Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verifiednpm · @budibase/server
- CVE-2026-73421NextAuth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)npm · next-auth · fixed in 5.0.0-beta.32
- CVE-2026-73428Trix: Stored XSS via HTMLParser attribute injection on pastenpm · trix · fixed in 2.1.18
- CVE-2026-73420NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypassnpm · @auth/core, next-auth · fixed in 0.41.3, 4.24.15, 5.0.0-beta.32
- CVE-2026-72855Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and RESTnpm · @budibase/server
- CVE-2026-72849Budibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRFnpm · @budibase/server