Vulnerabilities

ID
Packages
Summary
Published
arrow_upward
Attributes
GHSA-32gc-64m7-hj7v
  • npm/9router
9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header 2 hours ago
  • Fix available
  • Severity - 5.3 (Medium)
GHSA-5mj8-gf6m-fhw8
  • npm/9router
9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header 2 hours ago
  • Fix available
  • Severity - 7.3 (High)
MAL-2026-16386
  • npm/@mikudeveloper/baileys
Malicious code in @mikudeveloper/baileys (npm) 2 hours ago
  • No fix available
MAL-2026-16387
  • npm/@mr-supun-fernando/supunmd-bail
Malicious code in @mr-supun-fernando/supunmd-bail (npm) 2 hours ago
  • No fix available
MAL-2026-16385
  • npm/tlxbnhd
Malicious code in tlxbnhd (npm) 3 hours ago
  • No fix available
MAL-2026-16384
  • npm/tldriver
Malicious code in tldriver (npm) 3 hours ago
  • No fix available
MAL-2026-16383
  • npm/mxdriver
Malicious code in mxdriver (npm) 3 hours ago
  • No fix available
GHSA-798p-78g2-v556
  • npm/@aborruso/ckan-mcp-server
@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509 3 hours ago
  • Fix available
  • Severity - 5.7 (Medium)
GHSA-29hq-23m2-2j47
  • npm/@sync-in/server
Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory) 3 hours ago
  • Fix available
  • Severity - 5.3 (Medium)
GHSA-jx63-h26r-8cph
  • npm/@sync-in/server
Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters` 3 hours ago
  • Fix available
  • Severity - 6.5 (Medium)
GHSA-92cr-jxw4-5wjg
  • npm/@sync-in/server
Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token` 3 hours ago
  • Fix available
  • Severity - 8.1 (High)
GHSA-274f-6w77-8qm9
  • npm/@sync-in/server
@sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register` 3 hours ago
  • Fix available
  • Severity - 6.8 (Medium)
GHSA-jjhp-8crj-mppq
  • npm/@roomi-fields/notebooklm-mcp
@roomi-fields/notebooklm-mcp has a path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory 4 hours ago
  • Fix available
  • Severity - 7.1 (High)
MAL-2026-16380
  • npm/chai-logger
Malicious code in chai-logger (npm) 4 hours ago
  • No fix available
MAL-2026-16378
  • npm/@tesla-insurance/vinless-quote
Malicious code in @tesla-insurance/vinless-quote (npm) 4 hours ago
  • No fix available
MAL-2026-16379
  • npm/@user-services/web-components
Malicious code in @user-services/web-components (npm) 4 hours ago
  • No fix available