Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-56358n8n - Stored Cross-Site Scripting in Form Trigger Nodenpm · n8n · fixed in 2.11.2, 1.123.25
- CVE-2026-56351n8n - SQL Injection in MySQL, PostgreSQL, and Microsoft SQL Nodesnpm · n8n · fixed in 2.4.0
- CVE-2026-56272Flowise - Insufficient Password Salt Rounds in Bcrypt Hashingnpm · flowise · fixed in 3.0.13
- CVE-2026-56270Flowise - Unauthenticated OAuth Secrets Disclosure via /api/v1/loginmethod Endpointnpm · flowise · fixed in 3.1.0
- CVE-2026-56269Flowise - Weak Default Token Hash Secret in JWT Token Encryptionnpm · flowise · fixed in 3.1.0
- CVE-2026-56262Crawl4AI - Unauthenticated Access to Monitor Endpoints via Docker API ServerPyPI · crawl4ai · fixed in 0.8.7
- CVE-2025-71361picklescan - Remote Code Execution via Undetected idlelib.calltip.Calltip.fetch_tipPyPI · picklescan · fixed in 0.0.29
- CVE-2025-71354picklescan - Remote Code Execution via idlelib.debugobj.ObjectTreeItem.SetTextPyPI · picklescan · fixed in 0.0.29
- CVE-2025-71332Flowise - SQL Injection in importChatflows API via chatflow.id Parameternpm · flowise
- CVE-2026-12681Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Google go-attestation.Go · github.com/google/go-attestation · fixed in 0.6.1
- CVE-2026-54639Style Dictionary - Prototype Pollution in convertTokenData utility functionnpm · style-dictionary · fixed in 5.4.4
- CVE-2026-48493Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions AssignmentPackagist · snipe/snipe-it · fixed in 8.6.0
- CVE-2026-54588Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.Packagist · poweradmin/poweradmin · fixed in 4.2.4, 4.3.3
- CVE-2026-47693Poweradmin: CSV Injection in log export endpoints allows formula execution in spreadsheet applicationsPackagist · poweradmin/poweradmin · fixed in 4.2.4, 4.3.3
- CVE-2026-54518jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databindMaven · com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind · fixed in 2.21.4, 3.1.4
- CVE-2026-50193jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()Maven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.14.0
- CVE-2026-41862Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts withoMaven · org.springframework.statemachine:spring-statemachine-kryo · fixed in 4.0.2
- CVE-2026-54512jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiationMaven · com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind · fixed in 2.18.8, 3.1.4, 2.21.4
- CVE-2026-54513jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)Maven · com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind · fixed in 2.18.8, 2.21.4, 3.1.4
- CVE-2026-54514jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)Maven · com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind · fixed in 2.18.8, 2.21.4, 3.1.4
- CVE-2026-54515jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnorePropertiesMaven · com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind · fixed in 3.1.4, 2.18.9, 2.21.5 and more
- CVE-2026-54516jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fieldsMaven · com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind · fixed in 2.21.4, 3.1.4
- CVE-2026-54517jackson-databind: @JsonView bypass for setterless creator propertiesMaven · com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind · fixed in 2.21.4, 3.1.4
- CVE-2026-46547NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URLnpm · nocodb
- CVE-2026-46548NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams)npm · nocodb
- CVE-2026-46549NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalationnpm · nocodb
- CVE-2026-46550NocoDB: Refresh Token Cookie Set Without `Secure` and `SameSite` Flagsnpm · nocodb
- CVE-2026-46552NocoDB: Shared-base link access can invite arbitrary users as persistent base membersnpm · nocodb
- CVE-2026-46553NocoDB: Attachment Size Limit Bypass via Upload-by-URLnpm · nocodb
- CVE-2026-47375NocoDB: Postgres SQL Injection in Formula `ARRAYSORT`npm · nocodb · fixed in 2026.04.1