Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-1526undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompressionnpm · undici · fixed in 6.24.0, 7.24.0
- CVE-2026-1525undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')npm · undici · fixed in 6.24.0, 7.24.0
- CVE-2026-32269Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpointnpm · parse-server · fixed in 9.6.0-alpha.13, 8.6.39
- CVE-2026-32248Parse Server: Account takeover via operator injection in authentication data identifiernpm · parse-server · fixed in 9.6.0-alpha.12, 8.6.38
- CVE-2026-32242Parse Server OAuth2 adapter shares mutable state across providers via singleton instancenpm · parse-server · fixed in 9.6.0-alpha.11, 8.6.37
- CVE-2026-32237@backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpointnpm · @backstage/plugin-scaffolder-backend · fixed in 3.1.5
- CVE-2026-32236@backstage/plugin-auth-backend: SSRF in experimental CIMD metadata fetchnpm · @backstage/plugin-auth-backend · fixed in 0.27.1
- CVE-2026-32235@backstage/plugin-auth-backend: OAuth redirect URI allowlist bypassnpm · @backstage/plugin-auth-backend · fixed in 0.27.1
- CVE-2026-32230Uptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status pagenpm · uptime-kuma · fixed in 2.2.0
- CVE-2026-32141flatted: Unbounded recursion DoS in parse() revive phasenpm · flatted · fixed in 3.4.0
- CVE-2026-31873Unhead has a Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivitynpm · unhead · fixed in 2.1.11
- CVE-2026-31860Unhead has a XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol checknpm · unhead · fixed in 2.1.11
- CVE-2026-31841Raw exposure of database statements in Hyperterse MCP search toolnpm · hyperterse · fixed in 2.2.0
- CVE-2026-29066Arbitrary File Read via Disabled Vite Filesystem Restriction in TinaCMS CLInpm · @tinacms/cli · fixed in 2.1.8
- CVE-2026-28791Path Traversal in Media Upload Handle in Tinanpm · tinacms · fixed in 2.1.7
- CVE-2026-28793Path Traversal Leading to Arbitrary File Read, Write and Delete in TinaCMSnpm · @tinacms/cli · fixed in 2.1.8
- CVE-2026-28792Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMSnpm · @tinacms/cli · fixed in 2.1.8
- GHSA-MWV9-GP5H-FRR4Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `proto` own propertiesnpm · devalue · fixed in 5.6.4
- CVE-2026-24125Path Traversal in @tinacms/graphqlnpm · @tinacms/graphql · fixed in 2.1.2
- CVE-2026-4040OpenClaw File Existence tools.exec.safeBins information exposurenpm · openclaw · fixed in 2026.2.19
- CVE-2026-4039OpenClaw Skill Env applySkillConfigenvOverrides code injectionnpm · openclaw · fixed in 2026.2.21
- CVE-2026-2366Keycloak: keycloak: information disclosure via authorization bypass in admin apinpm · @keycloak/keycloak-admin-client
- CVE-2026-3965whyour qinglong API express.ts protection mechanismnpm · @whyour/qinglong · fixed in 2.20.2
- CVE-2026-31988yauzl 3.2.0 - Denial of Service via Off-by-One Error in NTFS Timestamp Parsernpm · yauzl · fixed in 3.2.1
- CVE-2026-32104StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's Settingsnpm · studiocms · fixed in 0.4.3
- CVE-2026-32106StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accountsnpm · studiocms · fixed in 0.4.3
- CVE-2026-32103StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generationnpm · studiocms · fixed in 0.4.3
- CVE-2026-32101StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Checknpm · @studiocms/s3-storage · fixed in 0.3.1
- CVE-2026-32234Parse Server has a SQL injection via query field name when using PostgreSQLnpm · parse-server · fixed in 9.6.0-alpha.10, 8.6.36
- CVE-2026-32098Parse Server has a protected fields bypass via LiveQuery subscription WHERE clausenpm · parse-server · fixed in 9.6.0-alpha.9, 8.6.35