Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-48069@grpc/grps-js: An incoming malformed compressed message can cause a client or server crashnpm · @grpc/grpc-js · fixed in 1.9.16, 1.10.12, 1.11.4 and more
- CVE-2026-48068@grpc/grps-js: A malformed request can cause a server crashnpm · @grpc/grpc-js · fixed in 1.9.16, 1.10.12, 1.11.4 and more
- CVE-2026-53633Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCEnpm · @vitest/browser, vite-plus · fixed in 5.0.0-beta.4, 4.1.8, 3.2.5 and more
- CVE-2026-47428Vitest browser mode serves unsanitized otelCarrier query parameter as inline scriptnpm · @vitest/browser · fixed in 4.1.6, 5.0.0-beta.3
- CVE-2026-47429Vitest: Arbitrary file can be read and executed when Vitest UI server is listeningnpm · vitest · fixed in 4.1.0, 3.2.6
- CVE-2026-48038joi: Uncaught RangeError on deeply nested input through recursive `link()` schemasnpm · joi · fixed in 18.2.1, 17.13.4
- CVE-2026-59891Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registrynpm · @sigstore/oci · fixed in 0.7.1
- CVE-2026-44745Open Redirect vulnerability in SAP Approuternpm · @sap/approuter · fixed in 21.2.0
- CVE-2026-27690HTTP Request Smuggling in SAP Approuternpm · @sap/approuter · fixed in 20.10.0
- CVE-2026-623289Router 0.4.41 - Unauthenticated Information Disclosure via API Usage Endpointsnpm · 9router
- CVE-2026-623279Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/statsnpm · 9router
- CVE-2026-62197OpenClaw < 2026.6.6 Policy Bypass via CDP Discoverynpm · openclaw · fixed in 2026.6.6
- CVE-2026-62188OpenClaw < 2026.6.9 Feishu Authorization Bypassnpm · @openclaw/feishu · fixed in 2026.6.9
- CVE-2026-62187OpenClaw < 2026.6.9 Feishu tools Authorization Bypassnpm · @openclaw/feishu · fixed in 2026.6.9
- CVE-2026-598019Router 0.4.41 - Unauthenticated API Exposure via /api/providersnpm · 9router
- CVE-2026-58500MCP Appium: Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGeneratorUI)npm · appium-mcp · fixed in 1.85.10
- CVE-2026-56271Flowise - Weak Default JWT Secrets in Authentication Middlewarenpm · flowise · fixed in 3.1.0
- CVE-2026-61448Parse Server 9.0.0 Stored XSS via malformed Content-Typenpm · parse-server · fixed in 9.10.0-alpha.2, 8.6.84
- CVE-2026-61426PraisonAI before 1.7.3 Unauthenticated Agent Access via Insecure Defaultsnpm · praisonai · fixed in 1.7.3
- CVE-2026-56763Hono - Prototype Pollution via __proto__ Key in parseBody with dot Optionnpm · hono · fixed in 4.12.7
- CVE-2026-61459MCP Server Kubernetes < 3.9.0 Argument Injection via kubectl Structured Toolsnpm · mcp-server-kubernetes · fixed in 3.9.0
- CVE-2026-566759router: Reverse proxy locality collapse allows unauthenticated access to 9router /v1 APIsnpm · 9router · fixed in 0.5.2
- CVE-2026-556389router: Unauthenticated LLM proxy access via /codex rewrite authorization bypassnpm · 9router · fixed in 0.5.2
- CVE-2026-556419router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRFnpm · 9router · fixed in 0.5.2
- CVE-2026-566769router: Image prefetch DNS rebinding allows SSRF to internal servicesnpm · 9router · fixed in 0.5.2
- CVE-2026-555009router: Exposure of Sensitive Information and Unprotected Database Import/Export Allows Complete Credential Theft and Database Takeovernpm · 9router
- CVE-2026-555019router: Login brute-force protection bypass via spoofed X-Forwarded-For headernpm · 9router · fixed in 0.4.77
- CVE-2026-58661n8n - Disk Space Exhaustion via Data-Table File Upload Endpointnpm · n8n · fixed in 2.28.0, 1.123.58
- CVE-2026-56354n8n - Cross-Site Scripting and Open Redirect in Form Nodenpm · n8n · fixed in 2.12.0, 2.10.4, 1.123.24
- CVE-2026-39244adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field.npm · adm-zip · fixed in 0.6.0