npm

RSS JSON

Friday, October 23
- GitHub CVE-2026-77366
  obsidian-tc tokens can access arbitrary configured vaults
  - The-40-Thieves obsidian-tc
  - Critical
  - CVSS 9.9
  - EPSS 0.31%
  - Fixed version listed
  17:29 UTC
Thursday, October 22
- GitHub GHSA-673q-mjm6-r5xr
  Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays
  - next (npm)
  - Critical
  - CVSS 9.5
  - Fixed version listed
  16:42 UTC
- GitHub GHSA-2464-fhr4-w9xw
  Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
  - next (npm)
  - Critical
  - CVSS 9.5
  - Fixed version listed
  15:52 UTC
- GitHub GHSA-cg2g-xh64-v4q7
  DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes
  - dompurify (npm)
  - Critical
  - CVSS 9.2
  - Fixed version listed
  16:25 UTC
- GitHub CVE-2026-114139
  Sentry-Javascript: Middleware Bypass when using Tunnel route
  - getsentry sentry-javascript
  - Critical
  - CVSS 9.1
  - EPSS 0.41%
  - Fixed version listed
  15:55 UTC
Wednesday, October 21
- GitHub CVE-2026-114125
  Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
  - storybookjs storybook
  - Critical
  - CVSS 9.4
  - EPSS 0.38%
  - Fixed version listed
  17:23 UTC
Thursday, October 15
- GitHub CVE-2026-102989
  TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
  - TanStack router
  - Critical
  - CVSS 9.3
  - EPSS 0.52%
  - Fixed version listed
  20:22 UTC
Friday, October 9
- GitHub CVE-2026-108261
  TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment
  - tinacms tinacms
  - Critical
  - CVSS 9.3
  - EPSS 0.16%
  - Fixed version listed
  20:56 UTC
Thursday, October 8
- CISA KEVGitHub CVE-2023-22894
  Strapi leaking sensitive user information by filtering on private fields
  - Strapi Strapi
  - High
  - CVSS 7.5
  - EPSS 3.61%
  - Fixed version listed
  CISA due Oct 11, 2026
- GitHub CVE-2026-107722
  fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion
  - nearform fast-jwt
  - Critical
  - CVSS 9.8
  - EPSS 0.27%
  - Fixed version listed
  22:02 UTC
- GitHub CVE-2026-106446
  Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)
  - handlebars-lang handlebars.js
  - Critical
  - CVSS 9.8
  - EPSS 0.64%
  - Fixed version listed
  17:52 UTC
- GitHub CVE-2026-106445
  Handlebars: JavaScript Injection via Own Property Check Bypass
  - handlebars-lang handlebars.js
  - Critical
  - CVSS 9.2
  - EPSS 0.41%
  - Fixed version listed
  17:52 UTC
Wednesday, October 7
- GitHub CVE-2026-105857
  Payload Form Builder has an RCE issue
  - payloadcms payload
  - Critical
  - CVSS 10.0
  - EPSS 0.43%
  - Fixed version listed
  20:28 UTC
- GitHub CVE-2026-93605
  vm2 contains a sandbox escape vulnerability
  - patriksimek vm2
  - Critical
  - CVSS 10.0
  - EPSS 0.73%
  - Fixed version listed
  18:05 UTC
- GitHub CVE-2026-106102
  Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()
  - quasarframework quasar
  - Critical
  - CVSS 10.0
  - EPSS 0.3%
  - Fixed version listed
  16:14 UTC
- GitHub CVE-2026-105859
  Payload: Unauthorized update to collection documents
  - payloadcms payload
  - Critical
  - CVSS 9.8
  - EPSS 0.35%
  - Fixed version listed
  20:28 UTC
- GitHub CVE-2026-106501
  Backstage: Sensitive information exposure in Scaffolder
  - backstage backstage
  - Critical
  - CVSS 9.6
  - EPSS 0.48%
  - Fixed version listed
  17:59 UTC
- GitHub CVE-2026-73483
  Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium
  - FlowiseAI Flowise
  - Critical
  - CVSS 9.4
  - EPSS 0.62%
  - Fixed version listed
  16:17 UTC
- GitHub CVE-2026-105863
  Payload authentication token field handling issue
  - payloadcms payload
  - Critical
  - CVSS 9.2
  - EPSS 0.38%
  - Fixed version listed
  20:28 UTC
- GitHub CVE-2026-73487
  Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass
  - FlowiseAI Flowise
  - Critical
  - CVSS 9.0
  - EPSS 0.96%
  - Fixed version listed
  16:17 UTC
Tuesday, October 6
- GitHub CVE-2026-105845
  Payload: SQL Injection in SQLite and Postgres
  - payloadcms payload
  - Critical
  - CVSS 9.8
  - EPSS 0.38%
  - Fixed version listed
  16:09 UTC
- GitHub CVE-2026-105851
  Payload: Field access control bypass on auth collections
  - payloadcms payload
  - Critical
  - CVSS 9.3
  - EPSS 0.25%
  - Fixed version listed
  16:17 UTC
- GitHub CVE-2026-105844
  Payload: Prototype pollution in Payload Import Export plugin
  - payloadcms payload
  - Critical
  - CVSS 9.3
  - EPSS 0.52%
  - Fixed version listed
  16:09 UTC
- GitHub CVE-2026-102422
  shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token
  - shell-quote (npm)
  - Critical
  - CVSS 9.2
  - EPSS 0.38%
  - Fixed version listed
  13:40 UTC
Monday, October 5
- GitHub CVE-2026-92955
  vm2: Sandbox Escape (NodeVM)
  - patriksimek vm2
  - Critical
  - CVSS 10.0
  - EPSS 0.71%
  - Fixed version listed
  22:47 UTC
- GitHub CVE-2026-92946
  vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE
  - patriksimek vm2
  - Critical
  - CVSS 10.0
  - EPSS 0.86%
  - Fixed version listed
  22:34 UTC
- GitHub CVE-2026-92947
  vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool
  - patriksimek vm2
  - Critical
  - CVSS 10.0
  - EPSS 0.48%
  - Fixed version listed
  22:34 UTC
- GitHub CVE-2026-92956
  vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass
  - patriksimek vm2
  - Critical
  - CVSS 10.0
  - EPSS 0.59%
  - Fixed version listed
  22:34 UTC
- GitHub CVE-2026-104846
  Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)
  - lxsmnsyc seroval
  - Critical
  - CVSS 9.8
  - EPSS 0.35%
  - Fixed version listed
  23:40 UTC
- GitHub CVE-2026-100721
  vm2: NodeVM custom resolution bypasses external path boundaries
  - patriksimek vm2
  - Critical
  - CVSS 9.5
  - EPSS 0.4%
  - Fixed version listed
  23:24 UTC
- GitHub CVE-2026-104848
  Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution
  - tinylibs tinypool
  - Critical
  - CVSS 9.5
  - EPSS 0.5%
  - Fixed version listed
  22:50 UTC
- GitHub CVE-2026-104849
  Tinypool: Prototype Pollution Gadget to RCE in run() options
  - tinylibs tinypool
  - Critical
  - CVSS 9.5
  - EPSS 0.39%
  - Fixed version listed
  22:49 UTC
- GitHub CVE-2026-92934
  vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit
  - patriksimek vm2
  - Critical
  - CVSS 9.5
  - EPSS 0.76%
  - Fixed version listed
  22:38 UTC
- GitHub CVE-2026-103922
  Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
  - ionic-team capacitor
  - Critical
  - CVSS 9.3
  - EPSS 0.21%
  - Fixed version listed
  22:53 UTC
- GitHub CVE-2026-92953
  vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix
  - patriksimek vm2
  - Critical
  - CVSS 9.3
  - EPSS 0.5%
  - Fixed version listed
  22:45 UTC
- GitHub CVE-2026-102829
  simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection
  - steveukx git-js
  - Critical
  - CVSS 9.2
  - EPSS 0.28%
  - Fixed version listed
  23:48 UTC
- GitHub CVE-2026-102828
  simple-git unsafe-operation guard does not block trailer command configuration
  - steveukx git-js
  - Critical
  - CVSS 9.2
  - EPSS 0.38%
  - Fixed version listed
  23:48 UTC
- GitHub CVE-2026-92954
  vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process
  - patriksimek vm2
  - Critical
  - CVSS 9.2
  - EPSS 0.49%
  - Fixed version listed
  22:45 UTC
- GitHub CVE-2026-90711
  proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
  - proxy-addr proxy-addr
  - Critical
  - CVSS 9.1
  - EPSS 0.26%
  - Fixed version listed
  23:30 UTC
Friday, October 2
- GitHub CVE-2026-10032
  @a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions
  - Google @a2ui/web_core
  - Critical
  - CVSS 9.3
  - EPSS 0.13%
  - Fixed version listed
  22:55 UTC
- GitHub GHSA-gg6r-gp4c-89hp
  Trigger.dev: V1 coordinator default-secret unauth Socket.IO
  - trigger.dev (npm)
  - Critical
  - CVSS 9.2
  - Fixed version listed
  22:39 UTC
Thursday, October 1
- GitHub CVE-2026-92940
  vm2 exposes host HTTPS credentials and TLS traffic through globalAgent
  - patriksimek vm2
  - Critical
  - CVSS 10.0
  - EPSS 0.47%
  - Fixed version listed
  15:38 UTC
- GitHub CVE-2026-92937
  vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection
  - patriksimek vm2
  - Critical
  - CVSS 10.0
  - EPSS 1.03%
  - Fixed version listed
  15:32 UTC
- GitHub CVE-2026-92941
  vm2 NodeVM can replace the host process TLS trust store
  - patriksimek vm2
  - Critical
  - CVSS 10.0
  - EPSS 0.29%
  - Fixed version listed
  15:27 UTC
- GitHub CVE-2026-92948
  vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape
  - patriksimek vm2
  - Critical
  - CVSS 9.9
  - EPSS 0.65%
  - Fixed version listed
  15:41 UTC
- GitHub CVE-2026-92951
  vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package
  - patriksimek vm2
  - Critical
  - CVSS 9.9
  - EPSS 0.54%
  - Fixed version listed
  15:37 UTC
- GitHub CVE-2026-92957
  vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process
  - patriksimek vm2
  - Critical
  - CVSS 9.9
  - EPSS 0.54%
  - Fixed version listed
  15:36 UTC
- GitHub CVE-2026-92938
  vm2 allows a sandboxed plugin to execute native code through `node:sqlite`
  - patriksimek vm2
  - Critical
  - CVSS 9.9
  - EPSS 0.62%
  - Fixed version listed
  15:29 UTC
- GitHub CVE-2026-92939
  vm2 crypto builtin loads attacker native code through setEngine
  - patriksimek vm2
  - Critical
  - CVSS 9.9
  - EPSS 0.62%
  - Fixed version listed
  15:28 UTC
- GitHub CVE-2026-92944
  vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector
  - patriksimek vm2
  - Critical
  - CVSS 9.8
  - EPSS 0.84%
  - Fixed version listed
  15:28 UTC
- GitHub CVE-2026-102992
  piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env
  - piscinajs piscina
  - Critical
  - CVSS 9.2
  - EPSS 0.43%
  - Fixed version listed
  15:03 UTC
- GitHub CVE-2026-92935
  vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE
  - patriksimek vm2
  - Critical
  - CVSS 9.0
  - EPSS 0.67%
  - Fixed version listed
  15:34 UTC
Wednesday, September 30
- GitHub GHSA-vcvr-r3jv-pc5j
  Next.js: Remote Code Execution in next/og ImageResponse
  - next (npm)
  - Critical
  - CVSS 9.5
  - Fixed version listed
  14:48 UTC
Tuesday, September 29
- GitHub CVE-2026-101894
  @xhmikosr/decompress: Path traversal via symlink chain
  - XhmikosR decompress
  - Critical
  - CVSS 9.1
  - EPSS 0.81%
  - Fixed version listed
  23:49 UTC
Thursday, September 24
- GitHub CVE-2026-59167
  SunEditor: Critical XSS vulnerability - sanitizer bypass
  - JiHong88 suneditor
  - Critical
  - CVSS 10.0
  - EPSS 0.39%
  - Fixed version listed
  14:57 UTC
- GitHub CVE-2026-61742
  DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution
  - bytebase dbhub
  - Critical
  - CVSS 9.3
  - EPSS 0.2%
  - Fixed version listed
  19:36 UTC

npm

Friday, October 23

Thursday, October 22

Wednesday, October 21

Thursday, October 15

Friday, October 9

Thursday, October 8

Wednesday, October 7

Tuesday, October 6

Monday, October 5

Friday, October 2

Thursday, October 1

Wednesday, September 30

Tuesday, September 29

Thursday, September 24