Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-53944Ghost: Private IP filtering bypass to make server-side requests to internal servicesnpm · ghost · fixed in 6.21.1
- CVE-2026-53945Ghost: Server-side request forgery via DNS rebinding in external request handlingnpm · ghost · fixed in 6.21.2
- CVE-2026-53946Ghost: Mobiledoc image-size fetch SSRFnpm · ghost · fixed in 6.21.2
- CVE-2026-53947Ghost: Member existence leak via magic link sign-in responsenpm · ghost · fixed in 6.21.2
- CVE-2026-53948Ghost: File Upload Content-Type Spoofingnpm · ghost · fixed in 6.21.1
- CVE-2026-53949Ghost Content API filter bypass reveals private fieldsnpm · ghost · fixed in 6.21.2
- CVE-2026-53950@tryghost/activitypub: XSS in Ghost's ActivityPub clientnpm · @tryghost/activitypub · fixed in 3.1.0
- CVE-2026-12537Unauthenticated Remote Code Execution in Gemini CLI CI/CD Workflowsnpm · @google/gemini-cli · fixed in 0.39.1, 0.40.0-preview.3
- CVE-2026-56761hono - HTML Injection via Improper JSX Attribute Name Handling in SSRnpm · hono · fixed in 4.12.14
- CVE-2026-56358n8n - Stored Cross-Site Scripting in Form Trigger Nodenpm · n8n · fixed in 2.11.2, 1.123.25
- CVE-2026-56351n8n - SQL Injection in MySQL, PostgreSQL, and Microsoft SQL Nodesnpm · n8n · fixed in 2.4.0
- CVE-2026-56272Flowise - Insufficient Password Salt Rounds in Bcrypt Hashingnpm · flowise · fixed in 3.0.13
- CVE-2026-56270Flowise - Unauthenticated OAuth Secrets Disclosure via /api/v1/loginmethod Endpointnpm · flowise · fixed in 3.1.0
- CVE-2026-56269Flowise - Weak Default Token Hash Secret in JWT Token Encryptionnpm · flowise · fixed in 3.1.0
- CVE-2025-71332Flowise - SQL Injection in importChatflows API via chatflow.id Parameternpm · flowise
- CVE-2026-54639Style Dictionary - Prototype Pollution in convertTokenData utility functionnpm · style-dictionary · fixed in 5.4.4
- CVE-2026-46547NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URLnpm · nocodb
- CVE-2026-46548NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams)npm · nocodb
- CVE-2026-46549NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalationnpm · nocodb
- CVE-2026-46550NocoDB: Refresh Token Cookie Set Without `Secure` and `SameSite` Flagsnpm · nocodb
- CVE-2026-46552NocoDB: Shared-base link access can invite arbitrary users as persistent base membersnpm · nocodb
- CVE-2026-46553NocoDB: Attachment Size Limit Bypass via Upload-by-URLnpm · nocodb
- CVE-2026-47375NocoDB: Postgres SQL Injection in Formula `ARRAYSORT`npm · nocodb · fixed in 2026.04.1
- CVE-2026-47376NocoDB: Reflected Cross-Site Scripting via Password Reset Tokennpm · nocodb · fixed in 2026.04.1
- CVE-2026-47377NocoDB: Open Redirect via Hash Fragment in hashRedirect Pluginnpm · nocodb · fixed in 2026.04.1
- CVE-2026-47378NocoDB: Hidden Column Exposure in Public Shared View Endpointsnpm · nocodb · fixed in 2026.04.1
- CVE-2026-47380NocoDB: User Enumeration via Sign-In Timingnpm · nocodb · fixed in 2026.04.1
- CVE-2026-46551NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustionnpm · nocodb
- CVE-2026-46554NocoDB: Stale Auth Cache After API Token Deletionnpm · nocodb
- CVE-2026-47382NocoDB: Server-Side Request Forgery via Database Connection Hostnpm · nocodb · fixed in 2026.05.1