Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-53523Nezha Monitoring: OAuth2 Redirect URL — Host Header InjectionGo · github.com/nezhahq/nezha · fixed in 2.2.0
- CVE-2026-53522Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoSGo · github.com/nezhahq/nezha · fixed in 2.2.0
- CVE-2026-53521Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile contextGo · github.com/nezhahq/nezha · fixed in 2.1.0
- CVE-2026-53520Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routingGo · github.com/nezhahq/nezha · fixed in 2.1.0
- CVE-2026-53519Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_keyGo · github.com/nezhahq/nezha · fixed in 2.0.13
- CVE-2026-49397Nezha Monitoring: Private services (`EnableShowInService: false`) are enumerable via per-server endpoints, leaking name and timing dataGo · github.com/nezhahq/nezha · fixed in 2.0.14
- CVE-2026-49396Nezha Monitoring: Cross-site GET request can trigger stored cron commands on a victim's agentsGo · github.com/nezhahq/nezha · fixed in 2.0.14
- CVE-2026-48119Nezha Monitoring: Authenticated agents can forge service-monitor results for other users' servicesGo · github.com/naiba/nezha, github.com/nezhahq/nezha · fixed in 1.14.15-0.20260521020202-02129f16fb15, 2.0.12
- CVE-2026-47124Nezha WebSocket server stream discloses cross-tenant server telemetry to authenticated membersGo · github.com/nezhahq/nezha · fixed in 1.14.15-0.20260517034128-05e5da253519
- CVE-2026-47120Nezha Monitoring: RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check)Go · github.com/nezhahq/nezha · fixed in 1.14.15-0.20260517022419-d7526351cf97
- CVE-2026-46717Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notificationGo · github.com/nezhahq/nezha · fixed in 1.14.15-0.20260517022419-d06d539d34c1
- CVE-2026-46716Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cronGo · github.com/nezhahq/nezha · fixed in 1.14.15-0.20260517022419-d7526351cf97
- CVE-2026-53609Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypassnpm · apostrophe · fixed in 4.31.0
- CVE-2026-53608@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tagnpm · @apostrophecms/seo · fixed in 1.5.0
- CVE-2026-47268Nezha Monitoring: Authenticated DDNS webhook configuration allows blind SSRF from the dashboard hostGo · github.com/naiba/nezha, github.com/nezhahq/nezha · fixed in 2.0.10
- CVE-2026-53607@apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host headernpm · apostrophe · fixed in 4.31.0
- CVE-2026-53606sanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and background attributesnpm · sanitize-html · fixed in 2.17.5
- CVE-2026-45013Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validationnpm · apostrophe
- CVE-2026-45012Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widgetnpm · apostrophe
- CVE-2026-45011Apostrophe has stored XSS via javascript: URL in Image Widget Linknpm · apostrophe
- CVE-2026-44990Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`npm · sanitize-html · fixed in 2.17.4
- CVE-2026-42853@apostrophecms/cli: Command Injection in apos create via Unsanitized Password Inputnpm · @apostrophecms/cli
- CVE-2026-42890actual Allows Electron to Run As Nodenpm · actual · fixed in 26.5.0
- CVE-2026-50552Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bailPackagist · phanan/koel · fixed in 9.7.1
- CVE-2026-47260Koel Vulnerable to SSRF via Podcast Episode Enclosure URLsPackagist · phanan/koel · fixed in 9.3.5
- CVE-2026-50287Missing Authentication for Critical Function in @agenticmail/mcpnpm · @agenticmail/mcp · fixed in 0.9.27
- CVE-2026-53726Parse Server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACLnpm · parse-server · fixed in 9.9.1-alpha.6, 8.6.80
- CVE-2026-53725Parse Server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is deniednpm · parse-server · fixed in 9.9.1-alpha.5
- CVE-2026-53724Parse Server: Stored XSS via trailing-dot filename bypassing file upload extension blocklistnpm · parse-server · fixed in 9.9.1-alpha.4, 8.6.79
- CVE-2026-50008Parse Server: Server option routeAllowList is bypassable through batch sub-requestsnpm · parse-server · fixed in 9.9.1-alpha.3