Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-111767MCP TypeScript SDK: Experimental tasks were not tied to the session that created themnpm · @modelcontextprotocol/sdk · fixed in 1.32.0
- CVE-2026-111756follow-redirects array-form headers bypass cross-origin credential strippingnpm · follow-redirects · fixed in 1.16.1
- CVE-2026-113711ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-exportnpm · @apostrophecms/import-export, apostrophe · fixed in 3.7.0, 4.33.0
- CVE-2026-113710ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessingnpm · apostrophe · fixed in 4.33.0
- CVE-2026-113671ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRFnpm · @apostrophecms/ai-helper · fixed in 1.0.0-beta.13
- CVE-2026-113669ApostropheCMS: Cross-domain session token in URL confers session takeovernpm · @apostrophecms/passport-bridge, apostrophe · fixed in 1.6.1, 4.33.0
- CVE-2026-113667ApostropheCMS: CAPTCHA response token not URL-encodednpm · @apostrophecms/form, @apostrophecms/login-hcaptcha +1 · fixed in 1.5.5, 1.3.0, 1.2.1
- CVE-2026-113668ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)npm · apostrophe · fixed in 4.33.0
- CVE-2026-113666ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of servicenpm · @apostrophecms/db-connect, apostrophe · fixed in 1.1.0, 4.33.0
- CVE-2026-113665ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpointsnpm · apostrophe · fixed in 4.33.0
- CVE-2026-113664ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring testnpm · @apostrophecms/import-export · fixed in 3.7.0
- CVE-2026-113662ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified documentnpm · @apostrophecms/import-export · fixed in 3.7.0
- CVE-2026-113661ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLsnpm · sanitize-html · fixed in 2.18.0
- CVE-2026-113660ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiersnpm · apostrophe · fixed in 4.33.0
- CVE-2026-113659ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated usersnpm · apostrophe · fixed in 4.33.0
- CVE-2026-113658ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directorynpm · apostrophe · fixed in 4.33.0
- CVE-2026-113657ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)npm · sanitize-html · fixed in 2.18.0
- CVE-2026-113656ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoSnpm · @apostrophecms/form · fixed in 1.5.5
- CVE-2026-113649ApostropheCMS: Import API bypasses publication roles for protected contentnpm · @apostrophecms/import-export, apostrophe · fixed in 3.7.1, 4.34.0
- CVE-2026-113655ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorizationnpm · apostrophe · fixed in 4.33.0
- CVE-2026-113654ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content rendernpm · sanitize-html · fixed in 2.18.0
- CVE-2026-113653ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)npm · apostrophe · fixed in 4.33.0
- CVE-2026-113652ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)npm · uploadfs · fixed in 1.28.0
- CVE-2026-113651ApostropheCMS: Path traversal in uploadfsnpm · uploadfs · fixed in 1.28.0
- CVE-2026-113650ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)npm · sanitize-html · fixed in 2.18.1
- CVE-2026-113648ApostropheCMS: Missing Authentication in `cleanExport` Routenpm · @apostrophecms/import-export · fixed in 3.7.1
- CVE-2026-112958ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serializationnpm · apostrophe · fixed in 4.34.0
- CVE-2026-112957ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged usersnpm · apostrophe · fixed in 4.34.0
- CVE-2026-112956ApostropheCMS: Archive duplicate continuation lets contributors overwrite published contentnpm · @apostrophecms/import-export · fixed in 3.7.1
- CVE-2026-112955ApostropheCMS: Import archives can exhaust server storage and deny servicenpm · @apostrophecms/import-export · fixed in 3.7.1