Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-47279NocoDB: Hidden LTAR Column Exposure in Public Shared-View Relation Endpointsnpm · nocodb · fixed in 2026.05.1
- CVE-2026-47379NocoDB: Plaintext Password Comparison in Shared Viewsnpm · nocodb · fixed in 2026.05.1
- CVE-2026-47381NocoDB: Cross-Workspace Integration Use in Connection Testnpm · nocodb · fixed in 2026.05.1
- CVE-2026-47383NocoDB: Stored Cross-Site Scripting via Row Commentsnpm · nocodb · fixed in 2026.05.1
- CVE-2026-47384NocoDB: SQL Injection via Column Title in Bulk GroupBynpm · nocodb · fixed in 2026.05.1
- CVE-2026-47385NocoDB: Path Traversal via SQLite Source Filenamenpm · nocodb · fixed in 2026.05.1
- CVE-2026-47386NocoDB: OAuth Authorization Code Race Conditionnpm · nocodb · fixed in 2026.05.1
- CVE-2026-47387NocoDB: Stored Cross-Site Scripting via Form View Redirect URLnpm · nocodb · fixed in 2026.05.1
- CVE-2026-47388NocoDB: Missing Ownership Check in MCP Attachment Readnpm · nocodb · fixed in 2026.05.1
- CVE-2026-53926NocoDB: OAuth Tokens Persist Through Security Eventsnpm · nocodb · fixed in 2026.05.1
- CVE-2026-53927NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URLnpm · nocodb
- CVE-2026-53928NocoDB: Refresh Tokens Persist Through Password Recoverynpm · nocodb
- CVE-2026-53929NocoDB: Stored Cross-Site Scripting via Secure Attachmentnpm · nocodb
- CVE-2026-53930NocoDB: Server-Side Request Forgery via Base Migration URLnpm · nocodb
- CVE-2026-53931NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpointnpm · nocodb
- CVE-2026-54327Pi: Race condition in auth.json writes could expose stored credentialsnpm · @earendil-works/pi-coding-agent, @mariozechner/pi-coding-agent · fixed in 0.78.1
- CVE-2026-54326Pi: Potential XSS in HTML session exports via Markdown URL sanitization bypassnpm · @earendil-works/pi-coding-agent, @mariozechner/pi-coding-agent · fixed in 0.78.1
- CVE-2026-54328Pi: Predictable temporary extension install paths allow local privilege escalation on shared Linux hostsnpm · @earendil-works/pi-coding-agent, @mariozechner/pi-coding-agent · fixed in 0.78.1
- CVE-2026-54325Pi loads project-local extensions without approvalnpm · @earendil-works/pi-coding-agent · fixed in 0.79.0
- CVE-2026-54157LobeHub: Unauthenticated SSRF in `/webapi/proxy`npm · @lobehub/lobehub · fixed in 2.1.57
- CVE-2026-54257Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflownpm · electron · fixed in 42.3.3
- CVE-2026-54316Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetchnpm · @anthropic-ai/claude-code · fixed in 2.1.163
- CVE-2026-12958Arbitrary file write in Language Servers for AWSnpm · @aws/lsp-codewhisperer · fixed in 0.0.117
- CVE-2026-12957Arbitrary Code Execution in Language Servers for AWSnpm · @aws/lsp-codewhisperer · fixed in 0.0.113
- CVE-2026-44792n8n: Source Control Pull SQL Injectionnpm · n8n · fixed in 1.123.43, 2.21.1, 2.20.7
- CVE-2026-44791n8n: XML Node Prototype Pollution Patch Bypassnpm · n8n · fixed in 1.123.43, 2.22.1, 2.20.7
- CVE-2026-44790n8n: Arbitrary File Read via Git Nodenpm · n8n · fixed in 1.123.43, 2.22.1, 2.20.7
- CVE-2026-44789n8n: HTTP Request Node Pagination Prototype Pollution to RCEnpm · n8n · fixed in 1.123.43, 2.22.1, 2.20.7
- CVE-2026-45732n8n: Cross-user Authorization Bypass in Dynamic Credential OAuth Endpointsnpm · n8n · fixed in 1.123.43, 2.21.1, 2.20.7
- CVE-2026-49444n8n: Python sandbox escapenpm · n8n · fixed in 1.123.48, 2.22.4, 2.21.8