Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-30948Parse Server has stored cross-site scripting (XSS) via SVG file uploadnpm · parse-server · fixed in 9.5.2-alpha.4, 8.6.17
- CVE-2026-30947Parse Server ha a bypass of class-level permissions in LiveQuerynpm · parse-server · fixed in 9.5.2-alpha.3, 8.6.16
- CVE-2026-30946Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL APInpm · parse-server · fixed in 8.6.15, 9.5.2-alpha.2
- CVE-2026-30837Elysia has a string URL format redosnpm · elysia · fixed in 1.4.26
- CVE-2026-29793NoSQL Injection via WebSocket id Parameter in MongoDB Adapternpm · @feathersjs/mongodb · fixed in 5.0.42
- CVE-2026-29792Feathersjs has an OAuth Callback Account Takeovernpm · @feathersjs/authentication-oauth · fixed in 5.0.42
- CVE-2026-28292simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key that enables RCEnpm · simple-git · fixed in 3.32.3
- CVE-2026-30973Zip Slip arbitrary file write in @appium/support ZIP extractionnpm · @appium/support · fixed in 7.0.6
- CVE-2026-30959OneUptime has WhatsApp Resend Verification Authorization Bypassnpm · @oneuptime/common · fixed in 10.0.21
- CVE-2026-26118Azure MCP Server Tools Elevation of Privilege Vulnerabilitynpm · @azure/mcp · fixed in 2.0.0-beta.17, 1.0.2
- CVE-2026-30957OneUptime Synthetic Monitor RCE via exposed Playwright browser objectnpm · @oneuptime/common · fixed in 10.0.21
- CVE-2026-30956OneUptime has authorization bypass via client‑controlled is-multi-tenant-query headernpm · @oneuptime/common · fixed in 10.0.21
- CVE-2026-30945StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Servicenpm · studiocms · fixed in 0.4.0
- CVE-2026-30944StudioCMS Affected by Privilege Escalation via Insecure API Token Generationnpm · studiocms · fixed in 0.4.0
- CVE-2026-30941Parse Server has a NoSQL injection via token type in password reset and email verification endpointsnpm · parse-server · fixed in 9.5.2-alpha.1, 8.6.14
- CVE-2026-30939Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolutionnpm · parse-server · fixed in 8.6.13, 9.5.1-alpha.2
- CVE-2026-30938Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placementnpm · parse-server · fixed in 8.6.12, 9.5.1-alpha.1
- CVE-2026-26801Server-Side Request Forgery (SSRF) vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitivenpm · pdfmake · fixed in 0.3.6
- CVE-2026-30925Parse Server affected by Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuerynpm · parse-server · fixed in 9.5.0-alpha.14, 8.6.11
- CVE-2026-30921OneUptime Synthetic Monitor RCE via exposed Playwright browser objectnpm · @oneuptime/common · fixed in 10.0.20
- CVE-2026-30920OneUptime has broken access control in GitHub App installation flow that allows unauthorized project bindingnpm · @oneuptime/common · fixed in 10.0.19
- CVE-2026-30887OneUptime Affected by Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCEnpm · @oneuptime/common · fixed in 10.0.18
- CVE-2026-30870Some sync filters in PowerSync Service ignored using `config.edition: 3`npm · @powersync/service-core, @powersync/service-sync-rules · fixed in 1.20.1, 0.33.0
- CVE-2026-31802node-tar Symlink Path Traversal via Drive-Relative Linkpathnpm · tar · fixed in 7.5.11
- CVE-2026-25041Budibase has a Command Injection in PostgreSQL Dump Commandnpm · @budibase/server · fixed in 3.23.32
- CVE-2026-3089Actual Sync Server 26.2.1 - Authenticated Path Traversalnpm · @actual-app/sync-server · fixed in 26.3.0
- CVE-2026-30854Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disablednpm · parse-server · fixed in 9.5.0-alpha.10
- CVE-2026-30850Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorizationnpm · parse-server · fixed in 8.6.9, 9.5.0-alpha.9
- CVE-2026-30848Parse Server: `PagesRouter` path traversal allows reading files outside configured pages directorynpm · parse-server · fixed in 8.6.8, 9.5.0-alpha.8
- CVE-2026-30863Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adaptersnpm · parse-server · fixed in 9.5.0-alpha.11, 8.6.10