Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-86000Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patternsPyPI · soupsieve · fixed in 2.9.0
- CVE-2026-86039libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addressesnpm · @libp2p/peer-store · fixed in 12.0.24
- CVE-2026-86038libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer IDnpm · @libp2p/gossipsub · fixed in 16.0.5
- CVE-2026-79752CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injectionPackagist · cakephp/cakephp, cakephp/database · fixed in 4.5.12, 4.6.5, 5.1.9 and more
- CVE-2026-61793Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameternpm · nuxt-og-image · fixed in 6.7.0
- CVE-2026-63459Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptionsnpm · @vendure/dashboard · fixed in 3.6.5
- CVE-2026-63461Vendure: Shop API list queries can return non-public entities when filterOperator is ORnpm · @vendure/core · fixed in 3.6.5
- CVE-2026-63472Vendure: External-authentication account takeover: external login linked to a pre-existing account by email without verificationnpm · @vendure/core · fixed in 3.7.0
- CVE-2026-63460Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backendsnpm · @vendure/core · fixed in 3.6.5
- CVE-2026-71538@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windowsnpm · @cyclonedx/cyclonedx-npm · fixed in 6.0.0
- CVE-2026-85078sanic chunked trailer request smuggling allows hidden second request executionPyPI · sanic · fixed in 24.12.1, 25.12.1
- CVE-2026-92963vm2 before 3.11.2 Information Disclosure via Internal Statenpm · vm2 · fixed in 3.11.2
- CVE-2026-92962vm2 before 3.11.4 Defense Invariant Violation via setup-sandbox.jsnpm · vm2 · fixed in 3.11.4
- CVE-2026-92961vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypassnpm · vm2 · fixed in 3.11.6
- CVE-2026-92960vm2 before 3.11.6 Process-wide State Exposure via os and dnsnpm · vm2 · fixed in 3.11.6
- CVE-2026-92959vm2 before 3.11.8 allowAsync Bypass via Promise Thenablenpm · vm2 · fixed in 3.11.8
- CVE-2026-92958vm2 before 3.11.7 Denylist Bypass via fs/promisesnpm · vm2 · fixed in 3.11.7
- CVE-2026-92957vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefixnpm · vm2 · fixed in 3.11.7
- CVE-2026-92956vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreamingnpm · vm2 · fixed in 3.11.7
- CVE-2026-92955vm2 before 3.11.8 Sandbox Escape via NodeVMnpm · vm2 · fixed in 3.11.8
- CVE-2026-92954vm2 3.10.0 through 3.11.7 Denial of Service via Host Promisenpm · vm2 · fixed in 3.11.8
- CVE-2026-92953vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArraynpm · vm2 · fixed in 3.11.8
- CVE-2026-92952vm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering Bypassnpm · vm2 · fixed in 3.11.7
- CVE-2026-92951vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolvernpm · vm2 · fixed in 3.11.7
- CVE-2026-92950vm2 before 3.11.7 Sandbox Escape via CLI requirenpm · vm2 · fixed in 3.11.7
- CVE-2026-92949vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptornpm · vm2 · fixed in 3.11.7
- CVE-2026-92948vm2 3.9.6 through 3.11.5 Sandbox Escape via node:testnpm · vm2 · fixed in 3.11.7
- CVE-2026-92947vm2 before 3.11.7 Memory Disclosure via Buffer Poolnpm · vm2 · fixed in 3.11.7
- CVE-2026-92946vm2 before 3.11.7 Remote Code Execution via require.externalnpm · vm2 · fixed in 3.11.7
- CVE-2026-92945vm2 before 3.11.7 Module Allowlist Bypass via Prefix Matchingnpm · vm2 · fixed in 3.11.7