What is being reported in npm and PyPI packages right now
The most recent reviewed advisories from the GitHub Advisory Database, refreshed every hour. Each one says which package and versions are affected and whether a fix exists. Where the underlying mistake is one people also make in their own code, the SixthWall rule that catches it is linked. RSS feed.
Are any of these in your project?
One command checks every installed package against the same database. It reads your lockfile and sends only package names and versions to osv.dev.
npx @sixthwall/cli deps80 advisories · 4 critical · 37 high · 32 medium · 7 low
filecoin-pin: Unbounded DAG pinning can exhaust server resources
- filecoin-pin <= 1.1.0 → update to 1.1.1
Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE
- banks <= 2.4.2 → update to 2.4.3
Same mistake in your own code? AI-PY-DESER-001 (code built from request data)
@payloadcms/storage-vercel-blob has access control bypass of uploads in Vercel Storage adapter
- @payloadcms/storage-vercel-blob >= 3.25.0, < 3.90.0 → update to 3.90.0
- @payloadcms/storage-vercel-blob >= 4.0.0-canary.0, < 4.0.0-canary.34 → update to 4.0.0-canary.34
odf-kit: HTML injection leading to XSS in odtToHtml() and odsToHtml() via unescaped style attribute values
- odf-kit >= 0.6.0, < 0.14.2 → update to 0.14.2
Same mistake in your own code? AI-XSS-001 (HTML inserted without sanitising)
Stanza: RCE via pickle deserialization in the lemmatizer
- stanza = 1.14.0 → update to 1.15.0
Same mistake in your own code? AI-PY-DESER-001 (code built from request data)
Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access
- @enspirit/elo <= 1.0.0 → update to 1.0.1
Same mistake in your own code? AI-XSS-001 (HTML inserted without sanitising), AI-PY-DESER-001 (code built from request data)
Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels
- @enspirit/elo <= 1.0.0 → update to 1.0.1
Same mistake in your own code? AI-PY-DESER-001 (code built from request data)
Elo backends have code injection via unvalidated emission of programmatic AST fields
- @enspirit/elo <= 1.0.0 → update to 1.0.1
Same mistake in your own code? AI-NEST-002 (request bodies accepted without validation), AI-INJECT-002 (SQL built from user input), AI-PY-DESER-001 (code built from request data)
DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation
- @bytebase/dbhub < 0.22.6 → update to 0.22.6
SD JWT JS: Tampered disclosures silently dropped instead of rejected
- @sd-jwt/decode <= 0.19.0 → no fix published yet
- @sd-jwt/core <= 0.19.0 → update to 0.20.0
pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search
- pypdf < 6.21.4 → update to 6.21.4
pypdf has possible large memory usage when parsing page tree
- pypdf < 6.21.4 → update to 6.21.4
pypdf has possible infinite loop when cloning dictionaries
- pypdf < 6.21.4 → update to 6.21.4
joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service
- joi >= 17.1.1, < 17.13.9 → update to 17.13.9
- @hapi/joi >= 16.0.0, <= 17.1.1 → no fix published yet
- joi >= 18.0.0, < 18.3.1 → update to 18.3.1
Same mistake in your own code? AI-REDOS-001 (regular expressions that can run forever)
@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service
- @hapi/content <= 6.0.2 → update to 6.0.3
- content >= 3.0.6, <= 4.0.6 → no fix published yet
Same mistake in your own code? AI-REDOS-001 (regular expressions that can run forever)
minimatch has potential denial of service via globparts amplification
- minimatch >= 7.0.0, < 11.0.1 → update to 11.0.1
Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal
- glob >= 9.0.0, <= 14.0.1 → update to 14.0.2
Authlib RFC 7592 examples omit registration-access-token client binding
- Authlib >= 0.15, <= 1.9.0 → update to 1.9.1
Same mistake in your own code? AI-IDOR-001 (records looked up by id without an owner check)
pypdf has possible long runtimes when retrieving page labels
- pypdf < 6.21.3 → update to 6.21.3
pypdf has possible large memory usage for exceptions in strict mode
- pypdf < 6.21.3 → update to 6.21.3
pypdf has possible long runtimes/large memory usage for encrypted PDF files
- pypdf < 6.21.3 → update to 6.21.3
pypdf has possible large memory usage when parsing cross-reference streams
- pypdf < 6.21.3 → update to 6.21.3
pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding
- pyasn1 <= 0.6.4 → update to 0.6.5
pyasn1 has quadratic-complexity denial of service in binary REAL decoding
- pyasn1 <= 0.6.4 → update to 0.6.5
pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding
- pyasn1 <= 0.6.4 → update to 0.6.5
pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decoding
- pyasn1 >= 0.3.3, < 0.6.5 → update to 0.6.5
Forge: ASN.1 OID first arc truncation in asn1.oidToDer
- node-forge <= 1.4.0 → update to 1.4.1
Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie
- node-forge <= 1.4.0 → update to 1.4.1
Same mistake in your own code? AI-INJECT-001 (objects merged from untrusted input)
Forge: TLS client crash when the server sends no certificate
- node-forge <= 1.4.0 → update to 1.4.1
Forge: Regular expression denial of service in PEM decoding (pem.decode)
- node-forge <= 1.4.0 → update to 1.4.1
Same mistake in your own code? AI-REDOS-001 (regular expressions that can run forever)
Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)
- node-forge <= 1.4.0 → update to 1.4.1
Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store
- node-forge <= 1.4.0 → update to 1.4.1
Same mistake in your own code? AI-TLS-001 (certificate checking switched off)
Forge: AES-GCM authentication bypass via unvalidated tagLength option
- node-forge <= 1.4.0 → update to 1.4.1
Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count
- node-forge <= 1.4.0 → update to 1.4.1
Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message
- node-forge <= 1.4.0 → update to 1.4.1
Forge: Denial of service in TLS record processing via call stack exhaustion
- node-forge <= 1.4.0 → update to 1.4.1
Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13
- node-forge <= 1.4.0 → update to 1.4.1
Same mistake in your own code? AI-TLS-001 (certificate checking switched off)
Nuxt dev server exposes generated appSecret through Vite file serving
- @nuxt/vite-builder >= 4.6.0, < 4.6.3 → update to 4.6.3
Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes
- nuxt >= 4.6.0, < 4.6.3 → update to 4.6.3
- @nuxt/nitro-server >= 4.6.0, < 4.6.3 → update to 4.6.3
Nuxt dev server arbitrary file read through client error reports
- @nuxt/vite-builder >= 4.6.0, < 4.6.3 → update to 4.6.3
Nuxt dev server exposes private runtime config through the Nitro dev bundle
- @nuxt/vite-builder >= 3.0.0, < 4.6.3 → update to 4.6.3
Same mistake in your own code? AI-SECRET-002 (secrets exposed to the browser)
@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location
- @sigstore/oci <= 0.7.1 → update to 0.7.2
follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects
- follow-redirects >= 1.16.0, <= 1.16.1 → update to 1.16.2
GraphQL-core has denial of service via memory leak in aborted validations
- graphql-core >= 3.3.0a3, < 3.3.1 → update to 3.3.1
OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client
- oauthlib < 4.0.0 → update to 4.0.0
OpenWISP Controller CA CRL REST API does not scope requests to managed organizations
- openwisp-controller >= 1.0.0, < 1.3.2 → update to 1.3.2
signalk-server has SSRF via absolute signalk.appIcon URL in the app store icon fetcher
- signalk-server >= 2.28.0-beta.2, < 2.34.0 → update to 2.34.0
Same mistake in your own code? AI-SSRF-001 (server fetching caller-supplied URLs)
Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution
- signalk-server >= 2.0.0, < 2.34.0 → update to 2.34.0
- @signalk/resources-provider >= 1.0.0, < 1.5.3 → update to 1.5.3
Same mistake in your own code? AI-PATH-001 (file paths built from the request)
joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection
- joserfc < 1.7.6 → update to 1.7.6
joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption
- joserfc < 1.7.5 → update to 1.7.5
@nx/maven and @nx/gradle have OS command injection via nx.json plugin options
- @nx/maven >= 22.0.2, < 22.7.9 → update to 22.7.9
- @nx/maven >= 23.0.0, < 23.1.2 → update to 23.1.2
- @nx/gradle >= 21.0.0, < 22.7.9 → update to 22.7.9
- @nx/gradle >= 23.0.0, < 23.1.2 → update to 23.1.2
Same mistake in your own code? AI-CMD-001 (shell commands built from variables)
decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs
- decode-uri-component <= 0.5.0 → update to 0.5.1
Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset
- Twisted <= 26.4.0 → update to 26.10.0rc1
Vite: `server.fs.deny` bypassed with queries
- vite = 6.4.4 → update to 6.4.5
Same mistake in your own code? AI-SUPA-002 (access control switched off)
@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy
- @eeacms/volto-chatbot <= 2.0.3 → update to 2.0.4
Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence
- @cedar-policy/cedar-wasm >= 4.0.1, < 4.11.1 → update to 4.11.1
- @cedar-policy/cedar-wasm >= 3.2.0, < 3.4.3 → update to 3.4.3
Same mistake in your own code? AI-NEST-002 (request bodies accepted without validation)
@sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY
- @sylphx/pdf-reader-mcp >= 2.2.0, < 3.0.1 → update to 3.0.1
Same mistake in your own code? AI-SECRET-002 (secrets exposed to the browser), AI-NEXT-001 (endpoints that never check who is asking)
PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox
- praisonai < 4.6.78 → update to 4.6.78
Same mistake in your own code? AI-PY-CMD-001 (shell commands built from variables)
Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist
- parse-server >= 9.0.0, < 9.10.0-alpha.2 → update to 9.10.0-alpha.2
- parse-server <= 8.6.83 → update to 8.6.84
Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks
- tornado < 6.6 → update to 6.6
Tornado: Open redirect in RedirectHandler via protocol-relative URLs
- tornado < 6.6 → update to 6.6
Same mistake in your own code? AI-REDIR-001 (redirects to request-supplied URLs)
Tornado: Quadratic CPU usage when parsing HTTP headers with line folding
- tornado < 6.6 → update to 6.6
systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks
- systeminformation < 5.33.16 → update to 5.33.16
Same mistake in your own code? AI-CMD-001 (shell commands built from variables)
Backstage catalog rules can be bypassed for URL locations using encoded path segments
- @backstage/plugin-catalog-backend < 3.9.2 → update to 3.9.2
- @backstage/plugin-catalog-backend >= 4.0.0, < 4.0.2 → update to 4.0.2
Same mistake in your own code? AI-PATH-001 (file paths built from the request)
Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it
- electrum < 4.8.3 → update to 4.8.3
Same mistake in your own code? AI-PY-CRYPTO-001 (weak hashing, guessable tokens or unverified JWTs)
Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)
- mem0ai < 2.0.18 → update to 2.0.18
Same mistake in your own code? AI-SECRET-002 (secrets exposed to the browser)
Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim
- social-auth-core <= 6.1.1 → update to 6.2.0
Same mistake in your own code? AI-WEBHOOK-001 (unverified webhooks), AI-SESSION-001 (session id kept across login)
ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank
- onnx >= 1.2.1, <= 1.21.0 → update to 1.22.0
ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs
- onnx <= 1.21.0 → update to 1.22.0
ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute
- onnx >= 1.4.0, <= 1.21.0 → update to 1.22.0
ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)
- onnx <= 1.21.0 → update to 1.22.0
vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server
- vllm < 0.32.0 → update to 0.32.0
Same mistake in your own code? AI-PY-CORS-001 (permissive CORS)
vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine
- vllm < 0.32.0 → update to 0.32.0
vLLM DeepSeek-OCR image processing vulnerable to denial of service
- vllm >= 0.11.1, < 0.32.0 → update to 0.32.0
vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE
- vllm < 0.32.0 → update to 0.32.0
Same mistake in your own code? AI-NEST-002 (request bodies accepted without validation)
vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled
- vllm < 0.32.0 → update to 0.32.0
Same mistake in your own code? AI-PY-DESER-001 (untrusted data handed to pickle, yaml.load or eval)
vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)
- vllm < 0.32.0 → update to 0.32.0
vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs
- vllm >= 0.16.0, < 0.32.0 → update to 0.32.0
vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool
- vllm >= 0.19.0, < 0.32.0 → update to 0.32.0
LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output
- langgraph-cli >= 0.4.15, <= 0.4.31 → update to 0.4.32
Same mistake in your own code? AI-LOG-001 (secrets written to logs)
Sources: GitHub Advisory Database, reviewed advisories for the npm and pip ecosystems; CISA Known Exploited Vulnerabilities catalog. SixthWall does not write these advisories; it shows them so you can act on them, and links each to the rule that prevents the same class of bug in code you write.