Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-71439Mermaid radar diagrams are vulnerable to DoSnpm · mermaid · fixed in 11.16.1
- CVE-2026-71438Mermaid configuration APIs allow prototype pollutionnpm · mermaid · fixed in 11.16.1, 10.9.8
- CVE-2026-50159Mermaid allows CSS injection applying to sibling elements of the diagramnpm · mermaid · fixed in 11.16.1, 10.9.8
- CVE-2026-71437Mermaid Architecture diagrams are vulnerable to prototype pollutionnpm · mermaid · fixed in 11.16.1
- CVE-2026-71436Mermaid XY Charts are vulnerable to an infinite loop DoSnpm · mermaid · fixed in 10.9.8, 11.16.1
- CVE-2026-71321Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validationnpm · nuxt · fixed in 4.5.1, 3.21.10
- CVE-2026-71320Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Propsnpm · nuxt · fixed in 4.5.1, 3.21.10
- CVE-2026-71319Nuxt.js Unauthenticated WebSocket RPC Call Leading to Remote Code Executionnpm · @nuxt/devtools · fixed in 3.3.1
- CVE-2026-71318Nuxt: Unauthorized Component Instantiation via Server Island Propsnpm · nuxt · fixed in 4.5.1, 3.21.10
- CVE-2026-71316Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clientsnpm · nuxt · fixed in 4.5.1
- CVE-2026-71315Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)npm · nuxt · fixed in 4.5.1, 3.21.10
- CVE-2026-71314Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island renderingnpm · nuxt · fixed in 4.5.1, 3.21.10
- CVE-2026-70612Electron: Sandboxed iframes can launch external protocol handlersnpm · electron · fixed in 39.8.8, 40.9.0, 41.2.1 and more
- CVE-2026-70611Electron: DevTools embedder handler executes arbitrary files via shell opennpm · electron · fixed in 39.8.9, 40.9.2, 41.2.1 and more
- CVE-2026-70610Electron: contextBridge object copy honors prototype settersnpm · electron · fixed in 39.8.9, 40.9.2, 41.2.2 and more
- CVE-2026-70609Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameternpm · electron · fixed in 39.8.7, 40.9.0, 41.2.0 and more
- CVE-2026-70608Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation pathnpm · electron · fixed in 42.0.1, 41.10.3, 39.8.10
- CVE-2026-70607Electron: window.open features string controls some window options considered privilegednpm · electron · fixed in 39.8.8, 40.9.0, 41.2.1 and more
- CVE-2026-70606Electron: ProtocolResponse.url reuses the default session cache instead of the registering sessionnpm · electron · fixed in 43.0.0, 42.5.1, 41.9.1 and more
- CVE-2026-70605Electron: HTTP redirect followed into local file loadernpm · electron · fixed in 39.8.8, 40.9.1, 41.2.1 and more
- CVE-2026-70604Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin readsnpm · electron · fixed in 42.0.0, 41.4.0, 40.9.3 and more
- CVE-2026-70603Electron: shell.openPath path validation bypass via embedded null bytenpm · electron · fixed in 42.0.0-beta.1, 41.1.1, 40.9.0 and more
- CVE-2026-70602Electron: Extension tab APIs operate across session boundariesnpm · electron · fixed in 39.8.8, 40.9.0, 41.2.1 and more
- CVE-2026-70601Electron: Context isolation bypass via Function.prototype.bind hijacknpm · electron · fixed in 39.8.9, 40.9.2, 41.2.2 and more
- CVE-2026-70600Electron: Cross-origin iframe can position native autofill popupnpm · electron · fixed in 39.8.8, 40.9.1, 41.2.1 and more
- CVE-2026-70599Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Originnpm · electron · fixed in 39.8.7, 40.9.0, 41.2.0 and more
- CVE-2026-70598Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory sizenpm · electron · fixed in 39.8.10, 40.9.0, 41.2.1 and more
- CVE-2026-70597Electron: Parent process code-sign check is spoofablenpm · electron · fixed in 39.8.8, 40.9.1, 41.2.1 and more
- CVE-2026-70596Ghost: Cross-Site Scripting in Feature Image Captionsnpm · ghost · fixed in 6.54.1
- CVE-2026-70595Ghost: Server-Side Request Forgery Mitigation Issuenpm · ghost · fixed in 6.54.1