Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-16584AWS API MCP Server Security Policy Bypass via Startup FailurePyPI · awslabs-aws-api-mcp-server · fixed in 1.3.47
- CVE-2026-65914DOMPurify before 3.3.2 Mutation XSS via Re-Contextualizationnpm · dompurify · fixed in 3.3.2
- CVE-2026-65913DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILESnpm · dompurify · fixed in 3.3.2
- CVE-2026-65912DOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTRnpm · dompurify · fixed in 3.3.2
- CVE-2026-65903DOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGSnpm · dompurify · fixed in 3.4.0
- CVE-2026-65902DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTagsnpm · dompurify · fixed in 3.4.7
- CVE-2026-65901DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeNamenpm · dompurify
- CVE-2026-65900DOMPurify before 3.4.8 Template Expression Injection via RETURN_DOMnpm · dompurify · fixed in 3.4.8
- CVE-2026-65899DOMPurify before 3.4.9 Trusted Types Policy State Contaminationnpm · dompurify · fixed in 3.4.9
- CVE-2026-65898DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfignpm · dompurify · fixed in 3.4.11
- CVE-2026-14257brace-expansion DoS via unbounded expansion length causing an out-of-memory process crashnpm · brace-expansion · fixed in 5.0.8, 3.0.3, 2.1.3 and more
- CVE-2026-65608Grav before 2.0.9 Remote Code Execution via FlexDirectoryPackagist · getgrav/grav · fixed in 2.0.9
- CVE-2026-65607SiYuan before v3.7.2 Path Traversal via /export/temp/Go · github.com/siyuan-note/siyuan/kernel · fixed in 0.0.0-20260510110132-b763d787d1f2
- CVE-2026-16723Remote Code Execution in fastjson 1.2.68–1.2.83Maven · com.alibaba:fastjson
- CVE-2026-15074@fastify/static vulnerable to route guard bypass via path traversalnpm · @fastify/static · fixed in 10.1.1
- CVE-2026-7120@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Pathsnpm · @fastify/static · fixed in 10.1.2
- CVE-2026-16629danger danger-js CLI localGetFileAtSHA.ts danger.git.diffForFile os command injectionnpm · danger · fixed in 13.0.8
- CVE-2026-65602Traefik before 3.6.23 IngressRouteTCP ServersTransport Namespace BypassGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 3.6.23, 3.7.7
- CVE-2026-65601Traefik before 3.7.7 Namespace Confusion via HTTPRoute ExtensionRefGo · github.com/traefik/traefik, traefik · fixed in 3.7.7
- CVE-2026-65600Traefik before v2.11.52 Authentication Bypass via ReplacePathRegexGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.52, 3.6.23, 3.7.7
- CVE-2026-65599n8n before 1.123.64, 2.29.8, and 2.30.1 Credential Exposure via JWT Headernpm · n8n · fixed in 1.123.64, 2.30.1, 2.29.8
- CVE-2026-65598n8n before 1.123.64 Remote Code Execution via Git Clonenpm · n8n · fixed in 1.123.64, 2.30.1, 2.29.8
- CVE-2026-65597n8n before 1.123.64 DOM-Based XSS via Unsandboxed iframenpm · n8n · fixed in 1.123.64, 2.30.1, 2.29.8
- CVE-2026-65596n8n before 1.123.64 Credential Exfiltration via GraphQL Nodenpm · n8n · fixed in 1.123.64, 2.30.1, 2.29.8
- CVE-2026-65595n8n before 2.29.8 and 2.30.1 Privilege Escalation via Token Exchangenpm · n8n · fixed in 2.30.1, 2.29.8
- CVE-2026-65594n8n before 2.30.1 Missing OAuth Authorization Checknpm · n8n · fixed in 2.30.1, 2.29.8
- CVE-2026-65593n8n before 1.123.64, 2.29.8, and 2.30.1 SSRF via Dynamic Node Parametersnpm · n8n · fixed in 1.123.64, 2.30.1, 2.29.8
- CVE-2026-65592n8n before 1.123.64 Stored DOM XSS via cachedResultUrlnpm · n8n · fixed in 1.123.64, 2.30.1, 2.29.8
- CVE-2026-65591n8n before 1.123.64 Sanitizer Bypass Remote Code Executionnpm · n8n · fixed in 1.123.64, 2.30.1, 2.29.8
- CVE-2026-65590n8n before 2.30.1 Shell Sandbox Bypass on Linux Windowsnpm · n8n · fixed in 2.30.1, 2.29.8