Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-34217SandboxJS has a Sandbox Escape via Prop Object Leak in New Handlernpm · @nyariv/sandboxjs · fixed in 0.8.36
- CVE-2026-34211SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parsernpm · @nyariv/sandboxjs · fixed in 0.8.36
- CVE-2026-34208SandboxJS: Sandbox integrity escapenpm · @nyariv/sandboxjs · fixed in 0.8.36
- CVE-2026-34148Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolutionnpm · @fedify/fedify, @fedify/vocab-runtime · fixed in 1.9.6, 1.10.5, 2.0.8 and more
- CVE-2026-33752Redirect-based SSRF leading to internal network access in curl_cffi (with TLS impersonation bypass)PyPI · curl-cffi · fixed in 0.15.0
- CVE-2026-33540Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realmGo · github.com/distribution/distribution, github.com/distribution/distribution/v3 · fixed in 3.1.0
- CVE-2026-37977Keycloak: org.keycloak.protocol.oidc.grants.ciba: keycloak: information disclosure via cors header injection due to unvalidated jwt azp claimMaven · org.keycloak:keycloak-services · fixed in 26.4.13, 26.6.3
- CVE-2026-31313An authenticated stored cross-site scripting (XSS) vulnerability in the creation/editing module of Feehi CMS v2.1.1 allows attackers to execPackagist · feehi/cms
- CVE-2026-31350An authenticated stored cross-site scripting (XSS) vulnerability in Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTPackagist · feehi/cms
- CVE-2026-31351An authenticated stored cross-site scripting (XSS) vulnerability in the creation/editing module of Feehi CMS v2.1.1 allows attackers to execPackagist · feehi/cms
- CVE-2026-31352An authenticated stored cross-site scripting (XSS) vulnerability in the Role Management module of Feehi CMS v2.1.1 allows attackers to execuPackagist · feehi/cms
- CVE-2026-31353An authenticated stored cross-site scripting (XSS) vulnerability in the Category module of Feehi CMS v2.1.1 allows attackers to execute arbiPackagist · feehi/cms
- CVE-2026-31354Multiple authenticated stored cross-site scripting (XSS) vulnerabilities in the Permissions module of Feehi CMS v2.1.1 allows attackers to ePackagist · feehi/cms
- CVE-2026-5603elgentos magento2-dev-mcp index.ts executeMagerun2Command os command injectionnpm · @elgentos/magento2-dev-mcp
- CVE-2026-5602Nor2-io heim-mcp new_heim_application tools.ts registerTools os command injectionnpm · @nor2/heim-mcp
- CVE-2026-5559AntaresMugisho PyBlade AST Validation sandbox.py _is_safe_ast special elements used in a template enginePyPI · pyblade
- CVE-2016-20054Nodcms Cross Site Request Forgery via admin endpointsPackagist · khodakhah/nodcms
- CVE-2026-34780Electron: Context Isolation bypass via contextBridge VideoFrame transfernpm · electron · fixed in 39.8.0, 40.7.0, 41.0.0-beta.8
- CVE-2026-34779Electron: AppleScript injection in app.moveToApplicationsFolder on macOSnpm · electron · fixed in 38.8.6, 39.8.1, 40.8.0 and more
- CVE-2026-34778Electron: Service worker can spoof executeJavaScript IPC repliesnpm · electron · fixed in 38.8.6, 39.8.1, 40.8.1 and more
- CVE-2026-34777Electron: Incorrect origin passed to permission request handler for iframe requestsnpm · electron · fixed in 38.8.6, 39.8.1, 40.8.1 and more
- CVE-2026-34776Electron: Out-of-bounds read in second-instance IPC on macOS and Linuxnpm · electron · fixed in 38.8.6, 39.8.1, 40.8.1 and more
- CVE-2026-34775Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processesnpm · electron · fixed in 38.8.6, 39.8.4, 40.8.4 and more
- CVE-2026-34774Electron: Use-after-free in offscreen child window paint callbacknpm · electron · fixed in 39.8.1, 40.7.0, 41.0.0
- CVE-2026-34773Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windowsnpm · electron · fixed in 38.8.6, 39.8.1, 40.8.1 and more
- CVE-2026-34772Electron: Use-after-free in download save dialog callbacknpm · electron · fixed in 38.8.6, 39.8.0, 40.7.0 and more
- CVE-2026-34771Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacksnpm · electron · fixed in 38.8.6, 39.8.0, 40.7.0 and more
- CVE-2026-34770Electron: Use-after-free in PowerMonitor on Windows and macOSnpm · electron · fixed in 38.8.6, 39.8.1, 40.8.0 and more
- CVE-2026-34768Electron: Unquoted executable path in app.setLoginItemSettings on Windowsnpm · electron · fixed in 38.8.6, 39.8.1, 40.8.0 and more
- CVE-2026-34767Electron: HTTP Response Header Injection in custom protocol handlers and webRequestnpm · electron · fixed in 38.8.6, 39.8.3, 40.8.3 and more