npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-8X4M-QW58-3PCXCriticalmppx: mppx has multiple payment bypass and griefing vulnerabilitiesCVE-2026-34215Highparse-server: Parse Server exposes auth data via verify password endpointCVE-2026-34210Mediummppx: mppx has Stripe charge credential replay via missing idempotency checkCVE-2026-34209Highmppx: mppx: Tempo has a session close voucher bypass vulnerability due to settled amount equalityCVE-2026-35628Mediumopenclaw: OpenClaw: Telegram Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook SecretGHSA-MW7W-G3MG-XQM7Mediumopenclaw: OpenClaw: BlueBubbles Group Reactions Bypass requireMention and Still Enqueue Agent-Visible System EventsCVE-2026-35647Mediumopenclaw: OpenClaw: Matrix Verification Notices Bypass Matrix DM Policy and Reply to Unpaired DM PeersCVE-2026-35623Mediumopenclaw: OpenClaw: BlueBubbles Webhook Missing Rate Limiting Enables Brute-Force Password GuessingCVE-2026-35669Highopenclaw: OpenClaw: Gateway Plugin HTTP Auth Grants Unrestricted operator.admin Runtime Scope to All CallersGHSA-FQW4-MPH7-2VR8Criticalopenclaw: OpenClaw: Silent privilege escalation via gateway shared-auth reconnectCVE-2026-35663Criticalopenclaw: OpenClaw: Gateway Backend Reconnect lets Non-Admin Operator Scopes Self-Claim operator.adminGHSA-9P93-7J67-5PC2Highopenclaw: OpenClaw: Gateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill Path Without Caller Scope BindingCVE-2026-4923Mediumpath-to-regexp: path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcardsCVE-2026-4926Highpath-to-regexp: path-to-regexp vulnerable to Denial of Service via sequential optional groupsCVE-2026-65914Mediumdompurify: DOMPurify is vulnerable to mutation-XSS via Re-Contextualization CVE-2026-4867Highpath-to-regexp: path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parametersCVE-2026-34076High@clerk/backend: Clerk: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended hostCVE-2026-33989High@mobilenext/mobile-mcp: @mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen capture toolsCVE-2026-33941Highhandlebars: Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and OptionsCVE-2026-33940Highhandlebars: Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partialCVE-2026-33939Highhandlebars: Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template CompilationCVE-2026-33938Highhandlebars: Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-blockCVE-2026-33937Criticalhandlebars: Handlebars.js has JavaScript Injection via AST Type ConfusionCVE-2026-34043Mediumserialize-javascript: Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objectsGHSA-364X-8G5J-X2PRMediumn8n: n8n has XSS in its Credential Management Flow

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo