Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-54345GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS)Go · github.com/gopacket/gopacket · fixed in 1.6.1
- CVE-2026-61609Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)Packagist · pterodactyl/panel · fixed in 1.13.0
- CVE-2026-54593Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissionsGo · github.com/pterodactyl/wings · fixed in 1.12.2
- CVE-2026-43910Appium java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutorMaven · io.appium:java-client · fixed in 10.1.1
- CVE-2026-45293WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerabilityPackagist · wp-coding-standards/wpcs · fixed in 3.4.1
- CVE-2026-47427GitHub MCP Server: Nil Pointer Dereference DoS in completion/complete HandlerGo · github.com/github/github-mcp-server · fixed in 1.1.0
- CVE-2026-54545@wakaru/cli arbitrary file write during bundle unpacknpm · @wakaru/cli · fixed in 1.4.0
- CVE-2026-53669React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)npm · react-router · fixed in 7.18.0
- CVE-2026-55685React Router: Unauthenticated Denial of Service via Inefficient Route Matchingnpm · react-router · fixed in 7.18.0
- CVE-2026-53668React Router: Open redirect can lead to XSSnpm · react-router, react-router-dom · fixed in 7.13.0, 6.30.6
- CVE-2026-53667React Router: Cross-site Scripting is Possible due to Missing RSCErrorHandler Protocol Validation (Incomplete fix for CVE-2026-53667)npm · react-router · fixed in 7.18.0
- CVE-2026-53666React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydrationnpm · react-router · fixed in 7.18.0
- CVE-2026-59730@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirectnpm · @astrojs/node · fixed in 11.0.2
- CVE-2026-59728@astrojs/rss: XML Injection via Unescaped RSS Feed Fieldsnpm · @astrojs/rss · fixed in 4.0.19
- CVE-2026-59727Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islandsnpm · astro · fixed in 7.0.4
- CVE-2026-59729Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)npm · astro · fixed in 7.0.6
- CVE-2026-64649Next.js: Server-Side Request Forgery in Server Actions on Custom Serversnpm · next · fixed in 15.5.21, 16.2.11
- CVE-2026-64648Next.js: Response Body Cache Confusion for Requests Containing Bodiesnpm · next · fixed in 15.5.21, 16.2.11
- CVE-2026-64647Next.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodiesnpm · next · fixed in 15.5.21, 16.2.11
- CVE-2026-64646Next.js: Unbounded Server Action payload in Edge runtimenpm · next · fixed in 15.5.21, 16.2.11
- CVE-2026-48051Papra: SSRF via HTTP redirect bypass in webhook deliverynpm · @papra/webhooks · fixed in 0.3.3
- CVE-2026-64644Next.js: Denial of Service in the Image Optimization API using SVGsnpm · next · fixed in 15.5.21, 16.2.11
- CVE-2026-55579Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromisePackagist · pheditor/pheditor · fixed in 2.0.6
- CVE-2026-55578Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injectionPackagist · pheditor/pheditor · fixed in 2.0.6
- CVE-2026-54540Authenticated terminal command whitelist bypass in PheditorPackagist · pheditor/pheditor · fixed in 2.0.5
- CVE-2026-48030Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter (CWE-78)Packagist · pheditor/pheditor · fixed in 2.0.4
- CVE-2026-64643Next.js: Unauthenticated Disclosure of Internal Server Function endpointsnpm · next · fixed in 15.5.21, 16.2.11
- CVE-2026-64642Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single localenpm · next · fixed in 16.2.11
- CVE-2026-64641Next.js: Denial of Service in App Router using Server Actionsnpm · next · fixed in 15.5.21, 16.2.11
- CVE-2026-64645Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostnamenpm · next · fixed in 15.5.21, 16.2.11