Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-69250Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltrationnpm · flowise · fixed in 3.1.3
- CVE-2026-48063Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payloadnpm · @whiskeysockets/baileys, baileys · fixed in 6.7.22, 7.0.0-rc12
- CVE-2026-69240Sequelize: SQL Injection (Oracle DB)npm · sequelize · fixed in 6.37.4
- CVE-2026-69198ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checksnpm · ip-address · fixed in 10.2.2
- CVE-2026-69192ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypassnpm · ip-address · fixed in 10.3.1
- CVE-2026-69185Socket.IO: Zero-attachment Memory Exhaustionnpm · socket.io-parser · fixed in 4.2.7, 3.4.5, 3.3.6
- CVE-2026-69153PostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unsetnpm · postcss · fixed in 8.5.23
- CVE-2026-69152brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigationnpm · brace-expansion · fixed in 1.1.18, 2.1.4, 3.0.6 and more
- CVE-2026-69151Angular i18n: Cross-Site Scripting (XSS) via event-handler attributesnpm · @angular/compiler, @angular/core · fixed in 22.0.1, 21.2.19, 20.3.27
- CVE-2026-69149Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)npm · @angular/platform-server · fixed in 22.0.7, 21.2.19, 20.3.27
- CVE-2026-68945Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoningnpm · @angular/common · fixed in 22.0.2, 21.2.19, 20.3.27
- CVE-2025-71401better-auth before 1.4.2 basePath Modification DoSnpm · better-auth · fixed in 1.4.2
- CVE-2025-71400better-auth passkey before 1.4.0 IDOR via delete-passkeynpm · @better-auth/passkey · fixed in 1.4.0
- CVE-2025-71399Better Auth before 1.4.5 Path Normalization Bypass via rou3npm · better-auth · fixed in 1.4.5
- CVE-2026-67336better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvidernpm · better-auth · fixed in 1.6.11
- CVE-2026-67321axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypassnpm · axios · fixed in 0.33.0, 1.18.0
- CVE-2026-67333better-auth before 1.6.13 Stored XSS via javascript redirect_urinpm · better-auth · fixed in 1.6.13, 1.7.0-beta.4
- CVE-2026-67319axios before 0.33.0 Prototype Pollution via nested option objectsnpm · axios · fixed in 0.33.0, 1.18.0
- CVE-2026-67329@better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscriptionnpm · @better-auth/stripe · fixed in 1.6.21, 1.7.0-beta.10
- CVE-2026-67318axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2npm · axios · fixed in 1.18.0
- CVE-2026-67316axios before 1.18.0 Prototype Pollution via bodyless methodsnpm · axios · fixed in 1.18.0, 0.33.0
- CVE-2026-67334better-auth Stale Sessions Persist After User Deletionnpm · @better-auth/scim, better-auth · fixed in 1.6.11
- CVE-2026-67315axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0npm · axios · fixed in 1.18.0, 0.33.0
- CVE-2025-71403better-auth before 1.1.20 Open Redirect via trustedOrigins Bypassnpm · better-auth · fixed in 1.1.21
- CVE-2026-67312axios 0.28.0 before 0.33.0 and 1.0.0 before 1.18.0 Denial of Service via formToJSONnpm · axios · fixed in 0.33.0, 1.18.0
- CVE-2026-67332@better-auth/oauth-provider before 1.7.0-beta.4 Authorization Bypassnpm · @better-auth/oauth-provider · fixed in 1.7.0-beta.4
- CVE-2026-67337better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCachenpm · better-auth · fixed in 1.4.9
- CVE-2025-71404better-auth before 1.1.16 Reflected XSS via error parameternpm · better-auth · fixed in 1.1.16
- CVE-2026-67327better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTPnpm · better-auth · fixed in 1.6.22, 1.7.0-beta.10
- CVE-2026-67331better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypassnpm · @better-auth/scim · fixed in 1.7.0-beta.4