Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-48037Hulumi: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posturenpm · @hulumi/baseline · fixed in 1.4.0
- CVE-2026-48036Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdictsnpm · @hulumi/drift · fixed in 1.4.0
- CVE-2026-48035Hulumi: AccountFoundation audit-delivery S3 bucket could be silently weakenednpm · @hulumi/baseline · fixed in 1.4.0
- CVE-2026-48033Hulumi: Policy packs bypassed by a forged Pulumi-URN logical namenpm · @hulumi/policies · fixed in 1.4.0
- CVE-2026-48032Hulumi: IAM-role policy checks bypassed when the role trusts multiple OIDC providersnpm · @hulumi/policies · fixed in 1.4.0
- CVE-2026-48034HULUMI-H5 bypass via decoy sibling resources targeting a different bucketnpm · @hulumi/policies · fixed in 1.4.0
- CVE-2026-66010DOMPurify before 3.4.12 Hook Bypass via CUSTOM_ELEMENT_HANDLINGnpm · dompurify · fixed in 3.4.12
- CVE-2026-47669DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCEnpm · dbgate · fixed in 7.1.9
- CVE-2026-47670DbGate Vulnerable to Authenticated Remote Code Execution via loadReader functionName code injectionnpm · dbgate-api · fixed in 7.1.9
- CVE-2026-47668DbGate: Unauthenticated Remote Code Execution via JSON Script Runnernpm · dbgate-serve · fixed in 7.1.9
- CVE-2026-65914DOMPurify before 3.3.2 Mutation XSS via Re-Contextualizationnpm · dompurify · fixed in 3.3.2
- CVE-2026-65913DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILESnpm · dompurify · fixed in 3.3.2
- CVE-2026-65912DOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTRnpm · dompurify · fixed in 3.3.2
- CVE-2026-65903DOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGSnpm · dompurify · fixed in 3.4.0
- CVE-2026-65902DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTagsnpm · dompurify · fixed in 3.4.7
- CVE-2026-65901DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeNamenpm · dompurify
- CVE-2026-65900DOMPurify before 3.4.8 Template Expression Injection via RETURN_DOMnpm · dompurify · fixed in 3.4.8
- CVE-2026-65899DOMPurify before 3.4.9 Trusted Types Policy State Contaminationnpm · dompurify · fixed in 3.4.9
- CVE-2026-65898DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfignpm · dompurify · fixed in 3.4.11
- CVE-2026-14257brace-expansion DoS via unbounded expansion length causing an out-of-memory process crashnpm · brace-expansion · fixed in 5.0.8, 3.0.3, 2.1.3 and more
- CVE-2026-15074@fastify/static vulnerable to route guard bypass via path traversalnpm · @fastify/static · fixed in 10.1.1
- CVE-2026-7120@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Pathsnpm · @fastify/static · fixed in 10.1.2
- CVE-2026-16629danger danger-js CLI localGetFileAtSHA.ts danger.git.diffForFile os command injectionnpm · danger · fixed in 13.0.8
- CVE-2026-65599n8n before 1.123.64, 2.29.8, and 2.30.1 Credential Exposure via JWT Headernpm · n8n · fixed in 1.123.64, 2.30.1, 2.29.8
- CVE-2026-65598n8n before 1.123.64 Remote Code Execution via Git Clonenpm · n8n · fixed in 1.123.64, 2.30.1, 2.29.8
- CVE-2026-65597n8n before 1.123.64 DOM-Based XSS via Unsandboxed iframenpm · n8n · fixed in 1.123.64, 2.30.1, 2.29.8
- CVE-2026-65596n8n before 1.123.64 Credential Exfiltration via GraphQL Nodenpm · n8n · fixed in 1.123.64, 2.30.1, 2.29.8
- CVE-2026-65595n8n before 2.29.8 and 2.30.1 Privilege Escalation via Token Exchangenpm · n8n · fixed in 2.30.1, 2.29.8
- CVE-2026-65594n8n before 2.30.1 Missing OAuth Authorization Checknpm · n8n · fixed in 2.30.1, 2.29.8
- CVE-2026-65593n8n before 1.123.64, 2.29.8, and 2.30.1 SSRF via Dynamic Node Parametersnpm · n8n · fixed in 1.123.64, 2.30.1, 2.29.8