Schwachstellen verstehen. Anwendungen schützen.

Hoch 20.10.2026

CVE-2026-113666

ApostropheCMS: Löschung von Prototyp-Eigenschaften durch Projektionsausschluss in @apostrophecms/db-connect führt zu Denial of Service

In ApostropheCMS können authentifizierte Benutzer über manipulierte Projektionsschlüssel in SQLite- und PostgreSQL-Adaptern Methoden im Prototyp löschen, was zu einem anhaltenden prozessweiten Denial of Service führt.

npm

apostrophe, @apostrophecms/db-connect

Niedrig 07.10.2026

CVE-2026-106101

Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service

npm

quasar

Mittel 05.10.2026

CVE-2026-104844

PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion

npm

postcss-selector-parser

Kritisch 05.10.2026

CVE-2026-104848

Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution

npm

tinypool

Kritisch 05.10.2026

CVE-2026-104849

Tinypool: Prototype Pollution Gadget to RCE in run() options

npm

tinypool

Kritisch 02.10.2026

CVE-2026-114088

Trigger.dev: V1 coordinator default-secret unauth Socket.IO

npm

trigger.dev

Hoch 18.09.2026

CVE-2026-77301

adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)

npm

adm-zip

Kritisch 15.09.2026

CVE-2026-61568

@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport

npm

@zereight/mcp-gitlab

Hoch 02.09.2026

CVE-2026-65842

Plate: SSRF with response disclosure in DOCX image embedding

npm

@platejs/docx-io

Mittel 02.09.2026

CVE-2026-82562

qs array-limit bypass via bracket-key comma parsing

npm

qs

Mittel 02.09.2026

CVE-2026-82417

qs: Denial of Service via Attacker Controlled isBuffer

npm

qs

Hoch 19.08.2026

CVE-2026-53957

Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint

npm

@contentful/mcp-server, @contentful/mcp-tools

Hoch 04.08.2026

CVE-2026-70473

Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

npm

flowise

Mittel 20.07.2026

CVE-2026-67316

Axios: Prototype pollution gadgets can alter axios request construction

npm

axios

Mittel 19.06.2026

CVE-2026-9679

undici vulnerable to HTTP header injection via Set-Cookie percent-decoding

npm

undici

Hoch 18.06.2026

CVE-2026-55388

piscina: Prototype Pollution Gadget → RCE via inherited options.filename

npm

piscina

Mittel 17.06.2026

CVE-2026-54325

Pi Agent: Pi loads project-local extensions without approval

npm

@earendil-works/pi-coding-agent

Hoch 15.06.2026

CVE-2026-49982

tmp: Type-confusion bypass of _assertPath allows path traversal via non-string prefix/postfix/template

npm

tmp

Hoch 29.05.2026

CVE-2026-44495

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

npm

axios

Hoch 29.05.2026

CVE-2026-44494

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

npm

axios

Mittel 22.05.2026

CVE-2026-8723

qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set

npm

qs

Mittel 11.05.2026

CVE-2026-41159

Mermaid: Improper sanitization of configuration leads to CSS injection

npm

mermaid

Hoch 05.05.2026

CVE-2026-42035

Axios: Header Injection via Prototype Pollution

npm

axios

Mittel 05.05.2026

CVE-2026-42044

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

npm

axios