Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-113664ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring testnpm · @apostrophecms/import-export · fixed in 3.7.0
- CVE-2026-113662ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified documentnpm · @apostrophecms/import-export · fixed in 3.7.0
- CVE-2026-113661ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLsnpm · sanitize-html · fixed in 2.18.0
- CVE-2026-113660ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiersnpm · apostrophe · fixed in 4.33.0
- CVE-2026-113659ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated usersnpm · apostrophe · fixed in 4.33.0
- CVE-2026-113658ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directorynpm · apostrophe · fixed in 4.33.0
- CVE-2026-113657ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)npm · sanitize-html · fixed in 2.18.0
- CVE-2026-113656ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoSnpm · @apostrophecms/form · fixed in 1.5.5
- CVE-2026-113649ApostropheCMS: Import API bypasses publication roles for protected contentnpm · @apostrophecms/import-export, apostrophe · fixed in 3.7.1, 4.34.0
- CVE-2026-113655ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorizationnpm · apostrophe · fixed in 4.33.0
- CVE-2026-113654ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content rendernpm · sanitize-html · fixed in 2.18.0
- CVE-2026-113653ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)npm · apostrophe · fixed in 4.33.0
- CVE-2026-113652ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)npm · uploadfs · fixed in 1.28.0
- CVE-2026-113651ApostropheCMS: Path traversal in uploadfsnpm · uploadfs · fixed in 1.28.0
- CVE-2026-113650ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)npm · sanitize-html · fixed in 2.18.1
- CVE-2026-113648ApostropheCMS: Missing Authentication in `cleanExport` Routenpm · @apostrophecms/import-export · fixed in 3.7.1
- CVE-2026-112958ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serializationnpm · apostrophe · fixed in 4.34.0
- CVE-2026-112957ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged usersnpm · apostrophe · fixed in 4.34.0
- CVE-2026-112956ApostropheCMS: Archive duplicate continuation lets contributors overwrite published contentnpm · @apostrophecms/import-export · fixed in 3.7.1
- CVE-2026-112955ApostropheCMS: Import archives can exhaust server storage and deny servicenpm · @apostrophecms/import-export · fixed in 3.7.1
- CVE-2026-112954ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST APInpm · apostrophe · fixed in 4.34.0
- CVE-2026-112953ApostropheCMS: Exposure of Sensitive Information via predictable export filenamesnpm · @apostrophecms/import-export · fixed in 3.7.1
- CVE-2026-112952ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated usernpm · apostrophe · fixed in 4.34.0
- CVE-2026-112951ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefixnpm · apostrophe · fixed in 4.34.0
- CVE-2026-112950Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fixnpm · @vitest/mocker · fixed in 4.1.12, 5.0.3
- CVE-2026-112949Vitest: Code injection via unauthenticated manual mock registrationnpm · @vitest/mocker · fixed in 4.1.12, 5.0.3
- CVE-2026-112948Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token filenpm · @vitest/browser, @vitest/ui +1 · fixed in 5.0.5, 1.3.0
- CVE-2026-111765A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fixMaven · org.a2aproject.sdk:a2a-java-sdk-http-client-android · fixed in 1.3.2.Final
- CVE-2026-112947Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`npm · vite, vite-plus · fixed in 8.3.3, 8.2.4, 1.1.0
- CVE-2026-111764A2A Java SDK has a fail-open default task authorizationMaven · org.a2aproject.sdk:a2a-java-sdk-server-common · fixed in 1.3.0.Final