Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-73654Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoSnpm · @trigger.dev/core · fixed in 4.5.6
- CVE-2026-49864wetty vulnerable to DOM XSS via file-download filenamenpm · wetty · fixed in 3.0.4
- CVE-2026-73653Vitest: Browser Mode provider commands bypass the file-access permission gatenpm · @vitest/browser · fixed in 4.1.10, 3.2.7, 5.0.0-beta.6
- CVE-2026-73651TypeORM: migration:generate template-literal code injectionnpm · typeorm · fixed in 0.3.31, 1.1.0
- CVE-2026-73650SVGO: removeScripts plugin leaves some executable scripts intactnpm · svgo · fixed in 2.8.3, 3.3.4, 4.0.2
- CVE-2026-73649Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of CVE-2026-44966 fix)npm · velocityjs · fixed in 2.1.7
- CVE-2026-73647Quasar Framework: Prototype pollution in Quasar extend() utilitynpm · quasar · fixed in 2.22.0
- CVE-2026-73645OpenZeppelin Confidential Contracts ERC7984ERC20Wrapper: once a wrapper is filled, subsequent wrap requests do not revert and result in loss of funds.npm · @openzeppelin/confidential-contracts · fixed in 0.3.1
- CVE-2026-73643js-yaml: Exponential parsing time in the flow collections leads to denial of servicenpm · js-yaml · fixed in 5.2.2
- CVE-2026-73569fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limitsnpm · fast-xml-parser · fixed in 5.10.1
- CVE-2026-73567sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clocknpm · sm-crypto · fixed in 0.5.0
- CVE-2026-73566node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selectionnpm · tar · fixed in 7.5.21
- CVE-2026-73565@hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshakenpm · @hono/node-server · fixed in 2.0.10
- CVE-2026-73563Backstage: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass in `@backstage/plugin-auth-backend`npm · @backstage/plugin-auth-backend · fixed in 0.29.2
- CVE-2026-73562Mongoose: Prototype pollution in the update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)npm · mongoose · fixed in 6.13.10, 7.8.10, 8.24.1 and more
- CVE-2026-73561Hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustionnpm · @anephenix/hub · fixed in 0.2.16
- CVE-2026-49856@jshookmcp/jshook: ICMP probe and traceroute skip local-network SSRF authorizationnpm · @jshookmcp/jshook · fixed in 0.3.2
- CVE-2026-49857auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopbacknpm · auth-fetch-mcp · fixed in 3.0.2
- CVE-2026-73618Budibase Server before 3.40.0 NoSQL Injection via JSON Parameternpm · @budibase/server
- CVE-2026-73617Budibase before 3.40.0 NoSQL Injection via MongoDB datasourcenpm · @budibase/server
- CVE-2026-73604Flowise before 3.1.3 Credential Exposure via APInpm · flowise · fixed in 3.1.3
- CVE-2026-73603Flowise before 3.1.4 Credential Abuse via Text-to-Speechnpm · flowise · fixed in 3.1.4
- CVE-2026-73488Flowise before 3.1.3 IDOR via customer-default-source endpointnpm · flowise · fixed in 3.1.3
- CVE-2026-73487Flowise before 3.1.3 Prompt Injection RCE via CSV Agentnpm · flowise, flowise-components · fixed in 3.1.3
- CVE-2026-73483Flowise before 3.1.3 Sandbox Escape via Puppeteernpm · flowise, flowise-components · fixed in 3.1.3
- CVE-2026-45819baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trignpm · baseline-browser-mapping · fixed in 2.11.0
- CVE-2026-19484@fastify/busboy vulnerable to Denial of Service via oversized multipart boundarynpm · @fastify/busboy · fixed in 3.2.1
- CVE-2026-19481@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part headernpm · @fastify/busboy · fixed in 3.2.1
- CVE-2026-49473@cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulationnpm · @cedar-policy/authorization-for-expressjs · fixed in 0.3.0
- CVE-2026-47718FUXA provides guest and invalid-token access to protected read APIs in secure modenpm · fuxa-server · fixed in 1.3.1