Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-106114ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensionsNuGet · sixlabors.imagesharp · fixed in 4.1.2, 3.2.0
- CVE-2026-106113ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram indexNuGet · sixlabors.imagesharp · fixed in 4.1.2
- CVE-2026-106112ImageSharp: ICC LUT16 output channel count can write beyond Vector4NuGet · sixlabors.imagesharp · fixed in 4.1.2
- CVE-2026-106111ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflateNuGet · sixlabors.imagesharp · fixed in 4.1.2
- CVE-2026-106110ImageSharp: TIFF CCITT T4 encoder can write past its compressed output bufferNuGet · sixlabors.imagesharp · fixed in 4.1.2
- CVE-2026-106109Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directoriesnpm · @quasar/app-vite · fixed in 3.3.0
- CVE-2026-106107Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrainednpm · @quasar/app-vite · fixed in 3.3.0
- CVE-2026-106106Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassablenpm · @quasar/app-vite, @quasar/render-ssr-error · fixed in 3.3.0, 2.2.4
- CVE-2026-106105Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissionsnpm · @quasar/app-vite, @quasar/cli +1 · fixed in 3.3.0, 5.0.4, 2.1.0
- CVE-2026-106104Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR servernpm · quasar · fixed in 2.23.3
- CVE-2026-106103Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profilenpm · @quasar/icongenie · fixed in 6.1.1
- CVE-2026-106102Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()npm · quasar · fixed in 2.22.0
- CVE-2026-106101Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Servicenpm · quasar · fixed in 2.32.2
- CVE-2026-106100Payload: Field-level write access bypass in Payload on MongoDBnpm · @payloadcms/db-mongodb · fixed in 3.87.0, 4.0.0-canary.20
- CVE-2026-105868Payload: Uploaded XML files could execute same-origin JavaScriptnpm · payload · fixed in 3.90.0, 4.0.0-canary.34
- CVE-2026-105867Payload: Client uploads could overwrite S3 objectsnpm · @payloadcms/storage-s3 · fixed in 3.90.0, 4.0.0-canary.34
- CVE-2026-105866Payload: Unauthenticated account-lockout denial of servicenpm · payload · fixed in 3.90.0, 4.0.0-canary.34
- CVE-2026-105865Payload: Incomplete validation during the upload file lifecyclenpm · payload · fixed in 3.90.0, 4.0.0-canary.34
- CVE-2026-105864Payload: Cross-tenant create in @payloadcms/plugin-multi-tenantnpm · @payloadcms/plugin-multi-tenant · fixed in 3.90.0, 4.0.0-canary.34
- CVE-2026-105863Payload authentication token field handling issuenpm · payload · fixed in 3.90.0, 4.0.0-canary.34
- CVE-2026-105862Payload: Bypassed sanitization of user uploaded SVGsnpm · payload · fixed in 3.90.0, 4.0.0-canary.34
- CVE-2026-105861Payload external upload trust validation issuenpm · payload · fixed in 3.90.0, 4.0.0-canary.34
- CVE-2026-105860Payload: Tenant authorization bypass in Multi-Tenant Pluginnpm · @payloadcms/plugin-multi-tenant · fixed in 3.90.0, 4.0.0-canary.34
- CVE-2026-105859Payload: Unauthorized update to collection documentsnpm · payload · fixed in 3.90.0, 4.0.0-canary.34
- CVE-2026-105858Payload: Remote Code Execution through first-registernpm · payload · fixed in 3.90.0, 4.0.0-canary.34
- CVE-2026-105857Payload: RCE in Payload Form Buildernpm · @payloadcms/plugin-form-builder · fixed in 3.90.0, 4.0.0-canary.34
- CVE-2026-105856Payload: SQL injection in SQLite/Postgresnpm · @payloadcms/db-d1-sqlite, @payloadcms/db-postgres +2 · fixed in 3.90.0, 4.0.0-canary.34, 3.73.0
- CVE-2026-105855Payload: Field-level password update restrictions were not enforcednpm · payload · fixed in 3.90.0, 4.0.0-canary.34
- CVE-2026-105854Payload: ReDoS in Multipart Content-Type Validationnpm · payload · fixed in 3.90.0, 4.0.0-canary.34
- CVE-2026-105853Payload: Token refresh and password reset responses may expose restricted user fieldsnpm · payload · fixed in 3.90.0, 4.0.0-canary.34