Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-59725Socket.IO: Engine.IO Polling Transport Connection Exhaustionnpm · engine.io · fixed in 6.6.7
- CVE-2026-59724Socket.IO: Engine.IO WebTransport SID DoSnpm · engine.io · fixed in 6.6.7
- CVE-2026-59876protobufjs: Text Format string map parsing can mutate returned map object prototypenpm · protobufjs · fixed in 8.6.5
- CVE-2026-59877protobufjs: Denial of Service via infinite loop in .proto option parsingnpm · protobufjs · fixed in 7.6.5, 8.6.6
- CVE-2026-59871node-tar: Process crash via PAX numeric path type confusionnpm · tar · fixed in 7.5.18
- CVE-2026-59874node-tar: Negative tar entry size causes infinite loop in archive replacenpm · tar · fixed in 7.5.18
- CVE-2026-59873node-tar: Decompression/parse DoS via unlimited inputnpm · tar · fixed in 7.5.19
- CVE-2026-59875node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath recordsnpm · tar · fixed in 7.5.17
- CVE-2026-59868js-yaml: YAML merge-key chains can force quadratic CPU consumptionnpm · js-yaml · fixed in 5.2.0
- CVE-2026-59869js-yaml: YAML merge-key chains can force quadratic CPU consumptionnpm · js-yaml · fixed in 3.15.0, 4.3.0
- CVE-2026-59870js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsingnpm · js-yaml · fixed in 5.2.1
- CVE-2026-57439CyberChef: Prototype pollution in Series Chart operationnpm · cyberchef · fixed in 11.2.0
- CVE-2026-59257n8n - SQL Injection in MySQL v1 executeQuery Operation via Expression Interpolationnpm · n8n · fixed in 1.123.61, 2.28.1, 2.27.4
- CVE-2026-59253n8n - Improper Authorization in Workflow Assignment to Foldersnpm · n8n · fixed in 2.28.0
- CVE-2026-56778n8n - Authorization Bypass in Public API Execution Retry Endpointnpm · n8n · fixed in 2.26.2, 2.25.7
- CVE-2026-56776n8n - Incorrect OAuth Scope Validation in Workflow Test Run Endpointnpm · n8n · fixed in 1.123.55, 2.26.2, 2.25.7
- CVE-2026-56775n8n - Incorrect OAuth Scope Validation in Evaluation Test Runs Endpointsnpm · n8n · fixed in 1.123.55, 2.26.2, 2.25.7
- CVE-2026-56360n8n - Webhook Forgery via Unsigned POST Requests in ZendeskTriggernpm · n8n · fixed in 1.123.18, 2.6.2
- CVE-2026-56359n8n - Cross-Site Scripting in Credential Management OAuth2 Authorization URLnpm · n8n · fixed in 2.8.0, 2.6.4
- CVE-2026-56273Flowise - Path Traversal in Vector Store basePath Parameternpm · flowise, flowise-components · fixed in 3.1.0
- CVE-2026-49229Actual: Disabled OpenID users keep access through existing session tokensnpm · @actual-app/sync-server · fixed in 26.6.0
- CVE-2026-50179Actual: CSV Formula Injection in Transaction Export via Imported Payee/Notes Fieldsnpm · @actual-app/web · fixed in 26.6.0
- CVE-2026-46700Actual: Missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secretsnpm · @actual-app/sync-server · fixed in 26.6.0
- CVE-2026-46672Actual: CSV Formula Injection in `@actual-app/cli` `--format csv` Output via Custom `escapeCsv` Helpernpm · @actual-app/cli · fixed in 26.6.0
- CVE-2026-598009Router < 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpointnpm · 9router · fixed in 0.4.44
- CVE-2026-56812Phoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiffnpm · phoenix · fixed in 1.5.15, 1.6.17, 1.7.24 and more
- CVE-2026-59710showdown - Stored XSS via Unescaped Table Header ID Attribute Injectionnpm · showdown
- CVE-2026-59711showdown - Cross-Site Scripting via Unescaped Metadata Title in completeHTMLDocumentnpm · showdown
- CVE-2026-59195pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-confignpm · pnpm · fixed in 10.34.4, 11.8.0
- CVE-2026-59196pnpm: hoisted install imports lockfile alias outside node_modulesnpm · pnpm · fixed in 10.34.4, 11.7.0