Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-47376NocoDB: Reflected Cross-Site Scripting via Password Reset Tokennpm · nocodb · fixed in 2026.04.1
- CVE-2026-47377NocoDB: Open Redirect via Hash Fragment in hashRedirect Pluginnpm · nocodb · fixed in 2026.04.1
- CVE-2026-47378NocoDB: Hidden Column Exposure in Public Shared View Endpointsnpm · nocodb · fixed in 2026.04.1
- CVE-2026-47380NocoDB: User Enumeration via Sign-In Timingnpm · nocodb · fixed in 2026.04.1
- CVE-2026-46551NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustionnpm · nocodb
- CVE-2026-46554NocoDB: Stale Auth Cache After API Token Deletionnpm · nocodb
- CVE-2026-47382NocoDB: Server-Side Request Forgery via Database Connection Hostnpm · nocodb · fixed in 2026.05.1
- CVE-2026-47279NocoDB: Hidden LTAR Column Exposure in Public Shared-View Relation Endpointsnpm · nocodb · fixed in 2026.05.1
- CVE-2026-47379NocoDB: Plaintext Password Comparison in Shared Viewsnpm · nocodb · fixed in 2026.05.1
- CVE-2026-47381NocoDB: Cross-Workspace Integration Use in Connection Testnpm · nocodb · fixed in 2026.05.1
- CVE-2026-47383NocoDB: Stored Cross-Site Scripting via Row Commentsnpm · nocodb · fixed in 2026.05.1
- CVE-2026-47384NocoDB: SQL Injection via Column Title in Bulk GroupBynpm · nocodb · fixed in 2026.05.1
- CVE-2026-47385NocoDB: Path Traversal via SQLite Source Filenamenpm · nocodb · fixed in 2026.05.1
- CVE-2026-47386NocoDB: OAuth Authorization Code Race Conditionnpm · nocodb · fixed in 2026.05.1
- CVE-2026-47387NocoDB: Stored Cross-Site Scripting via Form View Redirect URLnpm · nocodb · fixed in 2026.05.1
- CVE-2026-47388NocoDB: Missing Ownership Check in MCP Attachment Readnpm · nocodb · fixed in 2026.05.1
- CVE-2026-53926NocoDB: OAuth Tokens Persist Through Security Eventsnpm · nocodb · fixed in 2026.05.1
- CVE-2026-53927NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URLnpm · nocodb
- CVE-2026-53928NocoDB: Refresh Tokens Persist Through Password Recoverynpm · nocodb
- CVE-2026-9073Foreman-mcp-server: mcp server: insecure sensitive http header sanitizationPyPI · foreman-mcp-server
- CVE-2026-53929NocoDB: Stored Cross-Site Scripting via Secure Attachmentnpm · nocodb
- CVE-2026-53930NocoDB: Server-Side Request Forgery via Base Migration URLnpm · nocodb
- CVE-2026-53931NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpointnpm · nocodb
- CVE-2026-54327Pi: Race condition in auth.json writes could expose stored credentialsnpm · @earendil-works/pi-coding-agent, @mariozechner/pi-coding-agent · fixed in 0.78.1
- CVE-2026-54326Pi: Potential XSS in HTML session exports via Markdown URL sanitization bypassnpm · @earendil-works/pi-coding-agent, @mariozechner/pi-coding-agent · fixed in 0.78.1
- CVE-2026-54328Pi: Predictable temporary extension install paths allow local privilege escalation on shared Linux hostsnpm · @earendil-works/pi-coding-agent, @mariozechner/pi-coding-agent · fixed in 0.78.1
- CVE-2026-54325Pi loads project-local extensions without approvalnpm · @earendil-works/pi-coding-agent · fixed in 0.79.0
- CVE-2026-54762Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution failsGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 3.7.5
- CVE-2026-54761Traefik: Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist to expose internal Traefik servicesGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 3.6.21, 3.7.5
- CVE-2026-53622Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hostsGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.51, 3.7.3, 3.6.18