npm - OSV

GHSA-32gc-64m7-hj7v

npm/9router

9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header 2 hours ago

Fix available
Severity - 5.3 (Medium)

GHSA-5mj8-gf6m-fhw8

npm/9router

9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header 2 hours ago

Fix available
Severity - 7.3 (High)

MAL-2026-16386

npm/@mikudeveloper/baileys

Malicious code in @mikudeveloper/baileys (npm) 2 hours ago

No fix available

MAL-2026-16387

npm/@mr-supun-fernando/supunmd-bail

Malicious code in @mr-supun-fernando/supunmd-bail (npm) 2 hours ago

No fix available

MAL-2026-16385

npm/tlxbnhd

Malicious code in tlxbnhd (npm) 3 hours ago

No fix available

MAL-2026-16384

npm/tldriver

Malicious code in tldriver (npm) 3 hours ago

No fix available

MAL-2026-16383

npm/mxdriver

Malicious code in mxdriver (npm) 3 hours ago

No fix available

GHSA-798p-78g2-v556

npm/@aborruso/ckan-mcp-server

@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509 3 hours ago

Fix available
Severity - 5.7 (Medium)

GHSA-29hq-23m2-2j47

npm/@sync-in/server

Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory) 3 hours ago

Fix available
Severity - 5.3 (Medium)

GHSA-jx63-h26r-8cph

npm/@sync-in/server

Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters` 3 hours ago

Fix available
Severity - 6.5 (Medium)

GHSA-92cr-jxw4-5wjg

npm/@sync-in/server

Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token` 3 hours ago

Fix available
Severity - 8.1 (High)

GHSA-274f-6w77-8qm9

npm/@sync-in/server

@sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register` 3 hours ago

Fix available
Severity - 6.8 (Medium)

GHSA-jjhp-8crj-mppq

npm/@roomi-fields/notebooklm-mcp

@roomi-fields/notebooklm-mcp has a path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory 4 hours ago

Fix available
Severity - 7.1 (High)

MAL-2026-16380

npm/chai-logger

Malicious code in chai-logger (npm) 4 hours ago

No fix available

MAL-2026-16378

npm/@tesla-insurance/vinless-quote

Malicious code in @tesla-insurance/vinless-quote (npm) 4 hours ago

No fix available

MAL-2026-16379

npm/@user-services/web-components

Malicious code in @user-services/web-components (npm) 4 hours ago

No fix available

Vulnerabilities