Tagged “npm”
CVEs tagged npm, newest first.
1673 CVEsRSS
CVE-2026-105867Medium· 6.5Payload is a free and open source headless content management system
Payload is a free and open source headless content management system. In @payloadcms/storage-s3 versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user can overwrite an existing S3 object belonging to ano…
CVE-2026-105866High· 7.5Payload is a free and open source headless content management system
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an unauthenticated attacker who knows an account email address or username can abuse the account …
CVE-2026-105868High· 7.1Payload is a free and open source headless content management system
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, local upload configurations that accept XML files can store an XML file and stylesheet that execu…
CVE-2026-106100High· 7.1Payload is a free and open source headless content management system
Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that fie…
CVE-2026-105847Medium· 6.5Payload is a free and open source headless content management system
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a user who can query a collection with a polymorphic join to sensitive fields can infe…
CVE-2026-105846Medium· 6.1Payload is a free and open source headless content management system
Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an attacker can craft a redirect URL parameter that sends a guest user to an untruste…
CVE-2026-105851High· 8.1Payload is a free and open source headless content management system
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, the duplicate operation copies values from a source document even when a field is hidd…
CVE-2026-105848Critical· 9.6⚖ disputedPayload is a free and open source headless content management system
Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST pr…
CVE-2026-105853Medium· 6.5Payload is a free and open source headless content management system
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, token refresh responses and password reset responses can independently return hidden o…
CVE-2026-105852High· 7.5Payload is a free and open source headless content management system
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying a readable collection with a relationship to another collection can expose information a…
CVE-2026-105850High· 8.2Payload is a free and open source headless content management system
Payload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before 4.0.0-canary.34, use of the Stripe payment adapter can allow a Stripe order confirmat…
CVE-2026-105854High· 7.5Payload is a free and open source headless content management system
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a malformed multipart request body can cause multipart Content-Type processing to take…
CVE-2026-105849High· 8.3Payload is a free and open source headless content management system
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with…
CVE-2026-105855High· 7.1Payload is a free and open source headless content management system
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, the server fails to enforce a field-level access.update restriction on the password field of an a…
CVE-2026-105845Critical· 9.8Payload is a free and open source headless content management system
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query readable collections through dynamic filters or joins …
CVE-2026-105806High· 8.6Payload is a free and open source headless content management system
Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation …
CVE-2026-105844Critical· 9.3PoCPayload is a free and open source headless content management system
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an unauthenticated user can submit prototype-sensitive field paths when @payloadcms/pl…
CVE-2026-105805Medium· 6.9Payload is a free and open source headless content management system
Payload is a free and open source headless content management system. In versions before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query a readable collection, control its sorting, and select a protecte…
CVE-2026-104850High· 7.5PoCMCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to …
CVE-2026-105804Medium· 5.7Payload is a free and open source headless content management system
Payload is a free and open source headless content management system. Payload versions from 3.0.0 before 3.90.0 and canary versions from 4.0.0-canary.0 before 4.0.0-canary.34 use a lower-than-recommended PBKDF2 work factor for password h…
CVE-2026-105799Low· 2.3LangChain is a framework for building LLM-powered applications
LangChain is a framework for building LLM-powered applications. Prior to 1.1.1, @langchain/redis does not escape attacker-controlled values in structured RediSearch TAG filters and structured RediSearch TEXT filters, allowing injected Re…
CVE-2026-105800Low· 3.7PoCi18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno
i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that beg…
GHSA-wq5f-xc86-pv6wHighsharp : Vulnerability in librsvg dependency CVE-2026-96889
sharp : Vulnerability in librsvg dependency CVE-2026-96889
GHSA-r4xh-jqrq-34v2Medium· 5.3smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line
smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line
GHSA-6688-9rhm-gjv2LowDOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes
DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes
GHSA-g2v6-rqmx-r4w6High· 7.2@vue/server-renderer: XSS via missing CR in attribute-name blacklist
@vue/server-renderer: XSS via missing CR in attribute-name blacklist
GHSA-jggr-w7fw-pc2jMediumfast-copy: Stack exhaustion in fast-copy when copying deeply-nested values
fast-copy: Stack exhaustion in fast-copy when copying deeply-nested values
GHSA-g7fw-3gjp-g5hfMedium· 6.5OpenClaw: Channel read actions could skip target allowlists
OpenClaw: Channel read actions could skip target allowlists
GHSA-w2vw-w76x-qr89HighNx: OS command injection via git revisions and remote refs
Nx: OS command injection via git revisions and remote refs
CVE-2026-104852High· 8.2GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does n…