Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-49465n8n: Git Node Clone and Push Operations Bypass File Sandboxnpm · n8n · fixed in 1.123.48, 2.22.4, 2.21.8
- CVE-2026-54304n8n: SecurityScorecard Node Leaks API Token to User-Controlled Hostnpm · n8n · fixed in 1.123.55, 2.26.1, 2.25.7
- CVE-2026-54307n8n: Credential Exfiltration via Permission Bypassnpm · n8n · fixed in 1.123.55, 2.26.2, 2.25.7
- CVE-2026-54302n8n: Stored XSS in Chat Trigger Nodenpm · n8n · fixed in 1.123.55, 2.26.2, 2.25.7
- CVE-2026-54305n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpointsnpm · n8n · fixed in 1.123.55, 2.26.2, 2.25.7
- CVE-2026-54301n8n: Same-Origin XSS in Respond to Webhook Nodenpm · n8n · fixed in 1.123.55, 2.26.2, 2.25.7
- CVE-2026-54306n8n: Prototype Pollution enables confused-deputy execution via public webhooksnpm · n8n · fixed in 2.26.2, 2.25.7
- CVE-2026-54308n8n: Missing Token Validation on Microsoft Agent 365 Trigger Nodenpm · n8n · fixed in 2.26.2, 2.25.7
- CVE-2026-54311n8n: Merge Node SQL Mode Prototype Pollutionnpm · n8n · fixed in 2.26.2, 2.25.7
- CVE-2026-54310n8n: SQL Injection in Postgres v1/TimesclaeDB Nodesnpm · n8n · fixed in 2.26.2, 2.25.7
- CVE-2026-54309n8n: n8n MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessionsnpm · n8n · fixed in 2.26.2, 2.25.7
- CVE-2026-54314n8n: Denial of Service via ZIP decompression in webhook workflownpm · n8n · fixed in 2.24.0
- CVE-2026-54312n8n: Microsoft SQL Node Prototype Pollutionnpm · n8n · fixed in 2.24.0
- CVE-2026-54303n8n: Reflected XSS via Facebook, WhatsApp, and Microsoft Teams Trigger Webhook Verification Endpointsnpm · n8n · fixed in 2.24.0
- CVE-2026-54313n8n: NoSQL Injection in MongoDB Node Find And Replace Operationnpm · n8n · fixed in 2.24.0
- CVE-2026-56762Hono - Missing Cookie Name Validation in setCookie()npm · hono · fixed in 4.12.12
- CVE-2026-56301Nuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linuxnpm · nuxt · fixed in 4.4.7, 3.21.7
- CVE-2026-56275Flowise - Server-Side Request Forgery via Execute Flow Base URLnpm · flowise, flowise-components · fixed in 3.1.0
- CVE-2026-56274Flowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccessnpm · flowise, flowise-components · fixed in 3.1.2
- CVE-2025-71337Flowise - Unverified Email Change via Account Profile Endpointnpm · flowise-ui · fixed in 3.0.10
- CVE-2026-12866All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API.npm · expr-eval
- CVE-2026-56698Nuxt - Cross-Site Scripting via navigateTo open Optionnpm · nuxt · fixed in 4.4.7, 3.21.7
- CVE-2026-56697Nuxt - Open Redirect via Protocol-Relative Paths in reloadNuxtAppnpm · nuxt · fixed in 4.4.7, 3.21.7
- CVE-2026-56357n8n - Webhook Forgery via Missing HMAC-SHA256 Signature Verification in GitHub Webhook Triggernpm · n8n · fixed in 1.123.15, 2.5.0
- CVE-2026-56348n8n - Credential Exfiltration via Allowed HTTP Request Domains Bypass in Dynamic Node Parameters Endpointnpm · n8n · fixed in 2.20.0
- CVE-2026-56326Nuxt - Server-Side Open Redirect via Path-Normalization Bypass in navigateTonpm · nuxt · fixed in 4.4.7, 3.21.7
- CVE-2026-56268Flowise - Cross-Workspace Information Disclosure via chatflows/apikey Endpointnpm · flowise · fixed in 3.1.2
- CVE-2026-44311Fabric.js: Improper escaping in fabric.Gradient colorStops leads to XSS in SVG serializationnpm · fabric · fixed in 7.4.0
- CVE-2026-54281Nest: Middleware Bypass on Fastify via Trailing Slashnpm · @nestjs/platform-fastify · fixed in 11.1.24
- CVE-2026-55603http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`npm · http-proxy-middleware · fixed in 3.0.7, 4.1.1