Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-29786node-tar: Hardlink Path Traversal via Drive-Relative Linkpathnpm · tar · fixed in 7.5.10
- CVE-2026-29784Ghost: Incomplete CSRF protections around OTC usenpm · ghost · fixed in 6.19.3
- CVE-2026-29186@backstage/plugin-techdocs-node: TechDocs Mkdocs Configuration Key Enables Arbitrary Code Executionnpm · @backstage/plugin-techdocs-node · fixed in 1.14.3
- CVE-2026-29184@backstage/plugin-scaffolder-backend: Potential Session Token Exfiltration via Log Redaction Bypassnpm · @backstage/plugin-scaffolder-backend · fixed in 3.1.4
- CVE-2026-29185@backstage/integration: Potential reading of SCM URLs using built in tokennpm · @backstage/integration · fixed in 1.20.1
- CVE-2026-30830Defuddle: XSS via unescaped string interpolation in _findContentBySchemaText image tagnpm · defuddle · fixed in 0.9.0
- CVE-2026-30827express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting (all IPv4 clients share one bucket on dual-stack servers)npm · express-rate-limit · fixed in 8.2.2, 8.1.1, 8.0.2
- CVE-2026-30824Flowise: Missing Authentication on NVIDIA NIM Endpointsnpm · flowise · fixed in 3.0.13
- CVE-2026-30823Flowise: IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configurationnpm · flowise · fixed in 3.0.13
- CVE-2026-30822Flowise: Mass Assignment in `/api/v1/leads` Endpointnpm · flowise · fixed in 3.0.13
- CVE-2026-30821Flowise: Arbitrary File Upload via MIME Spoofingnpm · flowise · fixed in 3.0.13
- CVE-2026-30820Flowise Authorization Bypass via Spoofed x-request-from Headernpm · flowise · fixed in 3.0.13
- CVE-2026-30241Mercurius: queryDepth limit bypassed for WebSocket subscriptionsnpm · mercurius · fixed in 16.8.0
- CVE-2026-30835Parse Server: Malformed `$regex` query leaks database error details in API responsenpm · parse-server · fixed in 9.5.0-alpha.6, 8.6.7
- CVE-2026-30229Parse Server: Endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any usernpm · parse-server · fixed in 8.6.6, 9.5.0-alpha.4
- CVE-2026-30228Parse Server: File creation and deletion bypasses `readOnlyMasterKey` write restrictionnpm · parse-server · fixed in 9.5.0-alpha.3, 8.6.5
- CVE-2026-29182Parse Server: Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restrictionnpm · parse-server · fixed in 9.4.1-alpha.3, 8.6.4
- CVE-2026-29063Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutablenpm · immutable · fixed in 4.3.8, 5.1.5, 3.8.3
- CVE-2026-3419Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validationnpm · fastify · fixed in 5.8.1
- CVE-2026-29091Locutus: Remote Code Execution (RCE) in locutus call_user_func_array due to Code Injectionnpm · locutus · fixed in 3.0.0
- CVE-2026-29087@hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middlewarenpm · @hono/node-server · fixed in 1.19.10
- CVE-2026-29783GitHub Copilot CLI allows for dangerous shell expansion patterns that enable arbitrary command executionnpm · @github/copilot · fixed in 0.0.423
- CVE-2026-29074SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)npm · svgo · fixed in 2.8.1, 3.3.3, 4.0.1
- CVE-2026-28794oRPC: Prototype Pollution in `@orpc/client` via `StandardRPCJsonSerializer` Deserializationnpm · @orpc/client · fixed in 1.13.6
- CVE-2026-28787OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replaynpm · @oneuptime/common
- CVE-2026-29613OpenClaw < 2026.2.12 - Webhook Authentication Bypass via Loopback remoteAddress Trustnpm · openclaw · fixed in 2026.2.12
- CVE-2026-29612OpenClaw < 2026.2.14 - Denial of Service via Large Base64 Media File Decodingnpm · clawdbot, openclaw · fixed in 2026.2.14
- CVE-2026-29611OpenClaw < 2026.2.14 - Local File Inclusion via mediaPath Parameter in BlueBubbles Media Handlingnpm · openclaw · fixed in 2026.2.14
- CVE-2026-29610OpenClaw < 2026.2.14 - Command Hijacking via Unsafe PATH Handlingnpm · openclaw · fixed in 2026.2.14
- CVE-2026-29609OpenClaw < 2026.2.14 - Denial of Service via Unbounded URL-backed Media Fetchnpm · openclaw · fixed in 2026.2.14