Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-54350Budibase: Anonymous NoSQL operator injection via published-app query templatesnpm · @budibase/server · fixed in 3.39.12
- CVE-2026-50137Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentialsnpm · @budibase/server · fixed in 3.39.0
- CVE-2026-50136Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentialsnpm · @budibase/server · fixed in 3.39.2
- CVE-2026-50132Budibase: Chat Identity Link Hijacking via Missing Consent & CSRF — Account Impersonation in Budibasenpm · @budibase/server · fixed in 3.39.0
- CVE-2026-54352Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink uploadnpm · @budibase/server · fixed in 3.39.9
- CVE-2026-54753Nx: `nx graph` dev server permissive CORS policynpm · nx · fixed in 22.7.2, 23.0.0-beta.2
- CVE-2026-56876extract-zip unvalidated symlink path traversalnpm · extract-zip
- CVE-2026-11779PayloadCMS 3.84.1 - Authenticated account lockout bypass through default unlock accessnpm · payload
- CVE-2025-71338Flowise through 2.2.7 - Arbitrary File Write to Remote Code Execution via document-store APInpm · flowise
- CVE-2025-71336Flowise - Unsandboxed Remote Code Execution via Custom MCPnpm · flowise · fixed in 3.0.6
- CVE-2025-71335Flowise - Session Invalidation Failure After Password Changenpm · flowise · fixed in 3.0.10
- CVE-2025-71334Flowise - Arbitrary File Access via Missing Chat Flow ID Validationnpm · flowise · fixed in 3.0.6
- CVE-2025-71333Flowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpointnpm · flowise
- CVE-2025-71328Flowise - Unverified Password Change via Account Settingsnpm · flowise-ui · fixed in 3.0.10
- CVE-2025-71327Flowise - Authentication Bypass via Unprotected Registration Endpointnpm · flowise
- CVE-2025-71324Flowise - Arbitrary File Read via chatId Parameternpm · flowise · fixed in 3.0.6
- CVE-2021-47987Parse Server - Arbitrary Code Execution via Malicious Version Tagsnpm · parse-server · fixed in 4.5.2, 4.10.0
- CVE-2021-47986Parse Server - Unreviewed Code Execution via Malicious Version Tagsnpm · parse-server · fixed in 4.5.2, 4.10.0
- CVE-2026-55180pnpm: Repository config can expand victim environment secrets into registry requests before scripts runnpm · pnpm · fixed in 10.34.2, 11.5.3
- CVE-2026-48995pnpm: Tarball hash of GitHub git dependencies is not stored in lockfilenpm · pnpm · fixed in 10.33.4, 11.0.7
- CVE-2026-50017pnpm binds unscoped user-level npm auth credentials to a repository-selected registrynpm · pnpm · fixed in 10.34.0, 11.4.0
- CVE-2026-50016pnpm: Transitive dependency alias path traversal allows project path override via symlink replacementnpm · pnpm · fixed in 10.34.0, 11.4.0
- CVE-2026-50015pnpm: Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)npm · pnpm · fixed in 10.34.0, 11.4.0
- CVE-2026-50014pnpm: Git Fetch Argument Injection via Lockfile resolution.commitnpm · pnpm · fixed in 10.34.0, 11.4.0
- CVE-2026-50573pnpm: Unsafe default behavior breaks integrity checknpm · pnpm · fixed in 10.34.0, 11.4.0
- CVE-2026-50021pnpm: Integrity Check Bypass via Missing Lockfile Integrity Fieldnpm · pnpm · fixed in 11.4.0, 10.34.1
- CVE-2026-55700pnpm: stage download writes outside destination via manifest version traversalnpm · pnpm · fixed in 11.5.3
- CVE-2026-55699pnpm: reserved bin name deletes PNPM_HOME during global removenpm · pnpm · fixed in 10.34.2, 11.5.3
- CVE-2026-55698pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytesnpm · pnpm · fixed in 10.34.2, 11.5.3
- CVE-2026-55697pnpm: Repository-controlled configDependencies can select a pacquet native install enginenpm · pnpm · fixed in 10.34.2, 11.5.3