Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-35410Directus has an Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flownpm · directus · fixed in 11.16.1
- CVE-2026-35409Directus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Importnpm · directus · fixed in 11.16.0
- CVE-2026-35408Directus is Missing Cross-Origin Opener Policynpm · directus · fixed in 11.17.0
- CVE-2026-35394Mobile Next has Arbitrary Android Intent Execution via mobile_open_urlnpm · @mobilenext/mobile-mcp · fixed in 0.0.50
- CVE-2026-35213Regular Expression Denial of Service (ReDoS) in @hapi/content HTTP header parsingnpm · @hapi/content · fixed in 6.0.1
- CVE-2026-35200Parse Server has a file upload Content-Type override via extension mismatchnpm · parse-server · fixed in 9.7.1-alpha.4, 8.6.73
- CVE-2026-35209defu: Prototype pollution via `__proto__` key in defaults argumentnpm · defu · fixed in 6.1.5
- CVE-2026-35042fast-jwt accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)npm · fast-jwt
- CVE-2026-35039fast-jwt Affected by Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)npm · fast-jwt · fixed in 6.2.0
- CVE-2026-34841Axios npm Supply Chain Incident Impacting @usebruno/clinpm · @usebruno/cli · fixed in 3.2.1
- CVE-2026-34950fast-jwt has an incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Keynpm · fast-jwt · fixed in 6.2.0
- CVE-2026-34764Electron has a use-after-free in offscreen shared texture release() callbacknpm · electron · fixed in 39.8.5, 40.8.5, 41.1.0 and more
- CVE-2026-34217SandboxJS has a Sandbox Escape via Prop Object Leak in New Handlernpm · @nyariv/sandboxjs · fixed in 0.8.36
- CVE-2026-34211SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parsernpm · @nyariv/sandboxjs · fixed in 0.8.36
- CVE-2026-34208SandboxJS: Sandbox integrity escapenpm · @nyariv/sandboxjs · fixed in 0.8.36
- CVE-2026-34148Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolutionnpm · @fedify/fedify, @fedify/vocab-runtime · fixed in 1.9.6, 1.10.5, 2.0.8 and more
- CVE-2026-5603elgentos magento2-dev-mcp index.ts executeMagerun2Command os command injectionnpm · @elgentos/magento2-dev-mcp
- CVE-2026-5602Nor2-io heim-mcp new_heim_application tools.ts registerTools os command injectionnpm · @nor2/heim-mcp
- CVE-2026-34780Electron: Context Isolation bypass via contextBridge VideoFrame transfernpm · electron · fixed in 39.8.0, 40.7.0, 41.0.0-beta.8
- CVE-2026-34779Electron: AppleScript injection in app.moveToApplicationsFolder on macOSnpm · electron · fixed in 38.8.6, 39.8.1, 40.8.0 and more
- CVE-2026-34778Electron: Service worker can spoof executeJavaScript IPC repliesnpm · electron · fixed in 38.8.6, 39.8.1, 40.8.1 and more
- CVE-2026-34777Electron: Incorrect origin passed to permission request handler for iframe requestsnpm · electron · fixed in 38.8.6, 39.8.1, 40.8.1 and more
- CVE-2026-34776Electron: Out-of-bounds read in second-instance IPC on macOS and Linuxnpm · electron · fixed in 38.8.6, 39.8.1, 40.8.1 and more
- CVE-2026-34775Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processesnpm · electron · fixed in 38.8.6, 39.8.4, 40.8.4 and more
- CVE-2026-34774Electron: Use-after-free in offscreen child window paint callbacknpm · electron · fixed in 39.8.1, 40.7.0, 41.0.0
- CVE-2026-34773Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windowsnpm · electron · fixed in 38.8.6, 39.8.1, 40.8.1 and more
- CVE-2026-34772Electron: Use-after-free in download save dialog callbacknpm · electron · fixed in 38.8.6, 39.8.0, 40.7.0 and more
- CVE-2026-34771Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacksnpm · electron · fixed in 38.8.6, 39.8.0, 40.7.0 and more
- CVE-2026-34770Electron: Use-after-free in PowerMonitor on Windows and macOSnpm · electron · fixed in 38.8.6, 39.8.1, 40.8.0 and more
- CVE-2026-34768Electron: Unquoted executable path in app.setLoginItemSettings on Windowsnpm · electron · fixed in 38.8.6, 39.8.1, 40.8.0 and more