Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-33442Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys.npm · kysely · fixed in 0.28.14
- CVE-2026-32846OpenClaw < 2026.3.28 Media Parsing Path Traversal to Arbitrary File Readnpm · openclaw · fixed in 2026.3.28
- CVE-2026-4867path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parametersnpm · path-to-regexp · fixed in 1.9.0, 0.1.10, 8.0.0 and more
- CVE-2026-33397Angular SSR Vulnerable to Protocol-Relative URL Injection via Single Backslash Bypassnpm · @angular/ssr · fixed in 22.0.0-next.2, 21.2.3, 20.3.21
- CVE-2026-33285LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crashnpm · liquidjs
- CVE-2026-33287LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Patternnpm · liquidjs
- CVE-2026-33751n8n Vulnerable to LDAP Filter Injection in LDAP Nodenpm · n8n · fixed in 1.123.27, 2.14.1, 2.13.3
- CVE-2026-33749n8n Vulnerable to XSS via Binary Data Inline HTML Renderingnpm · n8n · fixed in 1.123.27, 2.14.1, 2.13.3
- CVE-2026-33724n8n's Source Control SSH Configuration Uses StrictHostKeyChecking=nonpm · n8n · fixed in 2.5.0
- CVE-2026-33722n8n Has External Secrets Authorization Bypass in Credential Savingnpm · n8n · fixed in 1.123.23, 2.6.4
- CVE-2026-33720n8n Has Authorization Bypass in OAuth Callback via N8N_SKIP_AUTH_ON_OAUTH_CALLBACKnpm · n8n · fixed in 2.8.0
- CVE-2026-33713n8n Vulnerable to SQL Injection in Data Table Node via orderByColumn Expressionnpm · n8n · fixed in 1.123.26, 2.14.1, 2.13.3
- CVE-2026-33696n8n Vulnerable to Prototype Pollution in XML & GSuiteAdmin node parameters lead to RCEnpm · n8n · fixed in 2.14.1, 2.13.3, 1.123.27
- CVE-2026-33665n8n: LDAP Email-Based Account Linking Allows Privilege Escalation and Account Takeovernpm · n8n · fixed in 2.4.0, 1.121.0
- CVE-2026-33663n8n Vulnerable to Credential Theft via Name-Based Resolution and Permission Checker Bypass in Community Editionnpm · n8n · fixed in 1.123.27, 2.14.1, 2.13.3
- CVE-2026-33660n8n Has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Modenpm · n8n · fixed in 2.14.1, 2.13.3, 1.123.27
- CVE-2026-27496n8n has In-Process Memory Disclosure in its Task Runnernpm · n8n · fixed in 1.123.22, 2.10.1, 2.9.3
- CVE-2026-26830pdf-image (npm package) through version 2.0.0 allows OS command injection via the pdfFilePath parameter.npm · pdf-image
- CVE-2026-26831textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors.npm · textract
- CVE-2026-26832node-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR.npm · node-tesseract-ocr
- CVE-2026-26833thumbler through 1.1.2 allows OS command injection via the input, output, time, or size parameter in the thumbnail() function because user inpm · thumbler
- CVE-2026-30587Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro,npm · @seafile/sdoc-editor · fixed in 3.0.75, 2.0.209
- CVE-2026-33349fast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluationnpm · fast-xml-parser · fixed in 4.5.5, 5.5.7
- CVE-2026-33331oRPC: Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringifynpm · @orpc/openapi · fixed in 1.13.9
- CVE-2026-33326@keystone-6/core: `isFilterable` bypass via `cursor` parameter in findManynpm · @keystone-6/core · fixed in 6.5.2
- CVE-2026-33769Astro: Remote allowlist bypass via unanchored matchPathname wildcardnpm · astro · fixed in 5.18.1
- CVE-2026-33768Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path`npm · @astrojs/vercel · fixed in 10.0.2
- CVE-2026-29772Astro: Memory exhaustion DoS due to missing request body size limit in Server Islandsnpm · @astrojs/node · fixed in 10.0.0
- CVE-2026-33627Parse Server: Auth data exposed via /users/me endpointnpm · parse-server · fixed in 9.6.0-alpha.55, 8.6.61
- CVE-2026-33624Parse Server: MFA recovery code single-use bypass via concurrent requestsnpm · parse-server · fixed in 9.6.0-alpha.54, 8.6.60