Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-72775n8n before 1.123.67 SQL Injection via PostgresTrigger Nodenpm · n8n · fixed in 1.123.67, 2.32.1, 2.31.5
- CVE-2026-72774n8n before 1.123.67 Authentication Bypass via HTTP Request Nodenpm · n8n · fixed in 1.123.67, 2.32.1, 2.31.5
- CVE-2026-72773n8n before 2.32.1 Path Traversal via computer-use search_filesnpm · n8n · fixed in 2.32.1, 2.31.5
- CVE-2026-72772n8n before 2.32.1 Authentication Bypass via Token Exchangenpm · n8n · fixed in 2.32.1, 2.31.5
- CVE-2026-72771n8n before 2.32.1 Credential Restriction Bypass via AI/LLM Nodesnpm · n8n · fixed in 2.32.1, 2.31.5
- CVE-2026-72770n8n before 1.123.67 Path Traversal via Git Node Operationsnpm · n8n · fixed in 1.123.67, 2.32.1, 2.31.5
- CVE-2026-72769n8n before 1.123.67 Prototype Pollution via VM Expression Enginenpm · n8n · fixed in 1.123.67, 2.32.1, 2.31.5
- CVE-2026-72768n8n before 2.32.1 SSRF Protection Bypass via MCP Clientnpm · n8n · fixed in 2.32.1, 2.31.5
- CVE-2026-72767n8n before 1.123.67 Remote Code Execution via Git nodenpm · n8n · fixed in 1.123.67, 2.32.1, 2.31.5
- CVE-2026-72766n8n before 1.123.67 Arbitrary File Read via Send Email Nodenpm · n8n · fixed in 1.123.67, 2.32.1, 2.31.5
- CVE-2026-72765n8n before 2.32.1 Remote Code Execution via Expression Sandbox Escapenpm · n8n · fixed in 2.32.1, 2.31.5
- CVE-2026-72764n8n before 1.123.67 Module Cache Poisoning via Code Nodenpm · n8n · fixed in 1.123.67, 2.32.1, 2.31.5
- CVE-2026-72763n8n before 1.123.67 Credential Exfiltration via Sub-Workflownpm · n8n · fixed in 1.123.67, 2.32.1, 2.31.5
- CVE-2026-72762n8n before 1.123.67 Arbitrary File Write via Edit Image Nodenpm · n8n · fixed in 1.123.67, 2.32.1, 2.31.5
- CVE-2026-72750n8n before 1.123.67 SQL Injection via executeQuery Operationnpm · n8n · fixed in 1.123.67, 2.32.1, 2.31.5
- CVE-2026-72749n8n before 1.123.67 Prototype Pollution via Edit Fieldsnpm · n8n · fixed in 1.123.67, 2.32.1, 2.31.5
- CVE-2026-72744Nuxt before 4.5.1 Information Disclosure via Chrome DevToolsnpm · nuxt · fixed in 4.5.1, 3.21.10
- CVE-2026-58230Multiple vulnerabilities in SAP Business AI Platform (Approuter)npm · @sap/approuter · fixed in 23.0.0
- CVE-2026-48170scimPatch vulnerable to prototype pollution via unfiltered keys in patchnpm · scim-patch · fixed in 0.9.1
- CVE-2026-69207Hono: ReDoS in CORS middleware via Access-Control-Request-Headersnpm · hono · fixed in 4.12.34
- CVE-2026-48007Element Call reports full URLs of visited pages to analytics servernpm · @element-hq/element-call-embedded · fixed in 0.19.4
- CVE-2026-71851crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chainnpm · crypto-js · fixed in 4.0.0
- CVE-2026-71850Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosurenpm · hono · fixed in 4.12.34
- CVE-2026-71849Hono: Proxy Helper does not remove response headers listed in the `Connection` headernpm · hono · fixed in 4.12.34
- CVE-2026-71848Hono: Algorithmic Complexity DoS in Language Middlewarenpm · hono · fixed in 4.12.34
- CVE-2026-66062SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept headernpm · @sveltejs/kit · fixed in 2.70.2
- CVE-2026-48054OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.urinpm · @openzeppelin/wizard · fixed in 0.10.9
- CVE-2026-71498node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScriptnpm · re2 · fixed in 1.26.1
- CVE-2026-71430node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string lengthnpm · re2 · fixed in 1.25.1
- CVE-2026-71476Nx: Zip-Slip in the self-hosted remote cachenpm · @nx/azure-cache, @nx/gcs-cache +7 · fixed in 22.7.7, 23.0.2