Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-39859LiquidJS has a renderFile() / parseFile() bypass configured root and allow arbitrary file readnpm · liquidjs · fixed in 10.25.5
- CVE-2026-39412LiquidJS has an ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channelnpm · liquidjs · fixed in 10.25.4
- CVE-2026-39411LobeHub has an unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` headernpm · @lobehub/lobehub · fixed in 2.1.48
- CVE-2026-35525LiquidJS has a root restriction bypass for partial and layout loading through symlinked templatesnpm · liquidjs · fixed in 10.25.3
- CVE-2026-23869A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-servernpm · react-server-dom-parcel, react-server-dom-turbopack +1 · fixed in 19.0.5, 19.1.6, 19.2.5
- CVE-2026-34166LiquidJS has a Memory Limit Bypass via Quadratic Amplification in `replace` Filternpm · liquidjs · fixed in 10.25.3
- CVE-2026-39410Hono has a non-breaking space prefix bypass in cookie name handling in getCookie()npm · hono · fixed in 4.12.12
- CVE-2026-39409Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addressesnpm · hono · fixed in 4.12.12
- CVE-2026-39408Hono has a path traversal in toSSG() allows writing files outside the output directorynpm · hono · fixed in 4.12.12
- CVE-2026-39407Hono has a middleware bypass via repeated slashes in serveStaticnpm · hono · fixed in 4.12.12
- CVE-2026-39406@hono/node-server has a middleware bypass via repeated slashes in serveStaticnpm · @hono/node-server · fixed in 1.19.13
- CVE-2026-39865Axios HTTP/2 Session Cleanup State Corruption Vulnerabilitynpm · axios · fixed in 1.13.2
- CVE-2026-34781Electron crashes in clipboard.readImage() on malformed clipboard image datanpm · electron · fixed in 39.8.5, 40.8.5, 41.1.0 and more
- CVE-2026-34765Electron named window.open targets not scoped to the opener's browsing contextnpm · electron · fixed in 39.8.5, 40.8.5, 41.1.0 and more
- CVE-2026-39397@delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered collectionsnpm · @delmaredigital/payload-puck · fixed in 0.6.23
- CVE-2026-39356SQL Injection via escapeName() in all Drizzle ORM SQL dialectsnpm · drizzle-orm · fixed in 0.45.2, 1.0.0-beta.20
- CVE-2026-39381Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields`npm · parse-server · fixed in 9.8.0-alpha.7, 8.6.75
- CVE-2026-39371RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requestsnpm · rwsdk · fixed in 1.0.6
- CVE-2026-39365Vite has a Path Traversal in Optimized Deps `.map` Handlingnpm · vite · fixed in 8.0.5, 7.3.2, 6.4.2
- CVE-2026-39364Vite has a `server.fs.deny` bypass with queriesnpm · vite · fixed in 8.0.5, 7.3.2
- CVE-2026-39363Vite Affected by Arbitrary File Read via Vite Dev Server WebSocketnpm · vite · fixed in 8.0.5, 7.3.2, 6.4.2
- CVE-2026-39321Parse Server has a login timing side-channel reveals user existencenpm · parse-server · fixed in 9.8.0-alpha.6, 8.6.74
- CVE-2026-35613Path traversal in coursevault-preview due to improper base-directory boundary validationnpm · coursevault-preview · fixed in 0.1.1
- CVE-2026-35515@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')npm · @nestjs/core · fixed in 11.1.18
- CVE-2025-56015In GenieACS 1.2.13, an unauthenticated access vulnerability exists in the NBI API endpoint.npm · genieacs
- CVE-2026-35442Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queriesnpm · directus · fixed in 11.17.0
- CVE-2026-35441Directus Affected by GraphQL Alias Amplification Denial-of-Service Due to Missing Query Cost/Complexity Limitsnpm · directus · fixed in 11.17.0
- CVE-2026-35413Directus GraphQL Schema SDL Disclosure Settingnpm · directus · fixed in 11.16.1
- CVE-2026-35412Directus has a TUS Upload Authorization Bypass Allows Arbitrary File Overwritenpm · directus · fixed in 11.16.1
- CVE-2026-35411Directus is an Open Redirect in Admin 2FA Setup Pagenpm · directus · fixed in 11.16.1