npm - OSV

MAL-2026-17638

npm/css-jptvix-polyfill

Malicious code in css-jptvix-polyfill (npm) 6 hours ago

No fix available

GHSA-mc52-mwq4-vfx3

npm/knowns

knowns OS Command Injection via Insecure LSP Binary Path Config in... 7 hours ago

Fix available
Severity - 7.8 (High)

GHSA-fx49-4h83-wjv9

npm/payload

Payload didn't enforce field-level password update restrictions 10 hours ago

Fix available
Severity - 7.6 (High)

GHSA-2g7p-5934-q4w7

npm/payload

Payload: ReDoS in Multipart Content-Type Validation 10 hours ago

Fix available
Severity - 8.7 (High)

GHSA-238x-w2j9-gwwr

npm/payload

Payload vulnerable to API key disclosure through ordinary document reads 10 hours ago

Fix available
Severity - 7.7 (High)

GHSA-8r29-2mp2-pmrw

npm/@payloadcms/plugin-ecommerce

Payload Ecommerce has an order confirmation validation issue 10 hours ago

Fix available
Severity - 8.8 (High)

GHSA-7c34-32v3-j575

npm/payload

Payload relationship-query authorization bypass 10 hours ago

Fix available
Severity - 6.9 (Medium)

GHSA-xgv3-crq2-6f69

npm/payload

Payload: Token refresh and password reset responses may expose restricted user... 10 hours ago

Fix available
Severity - 7.1 (High)

GHSA-r9v2-gg2j-22q5

npm/@payloadcms/plugin-stripe

Payload: Insufficient Access Control in Stripe REST Proxy 10 hours ago

Fix available
Severity - 6.4 (Medium)

GHSA-2q76-m6w6-qgc6

npm/@payloadcms/plugin-mcp

Payload: Improper access control for MCP API keys 10 hours ago

Fix available
Severity - 8.6 (High)

GHSA-qf28-8hc6-vwrp

npm/@payloadcms/plugin-import-export

Payload: Prototype pollution in Payload Import Export plugin 10 hours ago

Fix available
Severity - 9.3 (Critical)

GHSA-v49j-62m6-pgrr

npm/payload

Payload: SQL Injection in SQLite and Postgres 10 hours ago

Fix available
Severity - 9.8 (Critical)

GHSA-w84c-53h3-mc2g

npm/@payloadcms/next
npm/payload

Payload: Untrusted redirect URL parameter exploit 10 hours ago

Fix available
Severity - 6.1 (Medium)

GHSA-fpww-c55p-cjv6

npm/payload

Payload: Polymorphic join queries could disclose hidden fields 10 hours ago

Fix available
Severity - 7.1 (High)

GHSA-q6mq-ch85-c8mm

npm/payload

Payload: Password hashes use insufficient PBKDF2 iterations 11 hours ago

Fix available
Severity - 5.6 (Medium)

GHSA-9g87-32v6-3c2r

npm/payload

Payload: Sort queries could expose protected field information 11 hours ago

Fix available
Severity - 6.9 (Medium)

Vulnerabilities