Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-47717FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurationsnpm · fuxa-server · fixed in 1.3.1
- CVE-2026-73427Trix: XSS via JSON deserialization bypass in drag-and-drop (Level0InputController)npm · trix · fixed in 2.1.18
- CVE-2026-73425@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escapednpm · @astrojs/netlify · fixed in 8.1.2
- CVE-2026-73423Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misorderednpm · astro · fixed in 7.0.6
- CVE-2026-73422Astro: Reflected XSS via unescaped View Transition animation propertiesnpm · astro · fixed in 7.1.0
- CVE-2026-73419NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created themnpm · @auth/core, next-auth · fixed in 0.41.3, 5.0.0-beta.32, 4.24.15
- CVE-2026-73418NextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headersnpm · @auth/core, next-auth · fixed in 0.41.3, 5.0.0-beta.32, 4.24.15
- CVE-2026-73414Shescape: Shell injection via unescaped parentheses on Windows with CMDnpm · shescape · fixed in 2.1.14, 3.0.1
- CVE-2026-73413Shescape: Quadratic-time denial of service in flag-protectionnpm · shescape · fixed in 2.1.14, 3.0.1
- CVE-2026-73412Shescape: Path disclosure on Unix with Zshnpm · shescape · fixed in 2.1.14, 3.0.1
- CVE-2026-73411Shescape: Home-directory disclosure in assignment context on Unix with Dashnpm · shescape · fixed in 2.1.14, 3.0.1
- CVE-2026-73409Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFilenpm · @budibase/server
- CVE-2026-73407Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak (bypass of CVE-2026-48152))npm · @budibase/server
- CVE-2026-73406Budibase: Unauthenticated user information disclosure via public tenant user lookup endpointnpm · @budibase/server
- CVE-2026-73308Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Buildersnpm · @budibase/server
- CVE-2026-73307Budibase: SSRF via bare fetch() in uploadUrl during AI table generationnpm · @budibase/server
- CVE-2026-73306Budibase: Account Enumeration via Login Lockout Response Differentialnpm · @budibase/server
- CVE-2026-73303Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)npm · @budibase/server
- CVE-2026-73301Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappingsnpm · @budibase/server
- CVE-2026-73300Budibase: SQL Injection via `multipleStatements: true`npm · @budibase/server
- CVE-2026-73299Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderernpm · @prompty/core · fixed in 0.1.5, 2.0.0-beta.5
- CVE-2026-73231Faker: helpers.fake exploitable into arbritary code executionnpm · @faker-js/faker · fixed in 10.5.0
- CVE-2026-45618LiquidJS is Vulnerable to Remote Code Executionnpm · liquidjs · fixed in 10.26.0
- CVE-2026-73222Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)npm · claude-code-templates · fixed in 1.29.4
- CVE-2026-73089Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOMnpm · browserslist · fixed in 4.28.7
- CVE-2026-73088Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)npm · browserslist · fixed in 4.28.7
- CVE-2026-73086nanoid: Integer Overflow or Wraparoundnpm · nanoid · fixed in 3.3.12, 5.1.11
- CVE-2026-72925SWC HTML minifier may allow script element breakout when minifying embedded JSONnpm · @swc/html · fixed in 1.15.47-nightly-20260729.1
- CVE-2026-72775n8n before 1.123.67 SQL Injection via PostgresTrigger Nodenpm · n8n · fixed in 1.123.67, 2.32.1, 2.31.5
- CVE-2026-72774n8n before 1.123.67 Authentication Bypass via HTTP Request Nodenpm · n8n · fixed in 1.123.67, 2.32.1, 2.31.5