npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-35649Lowopenclaw: OpenClaw: Tlon settings empty-allowlist reconciliation bypassed intended revocation CVE-2026-35637Mediumopenclaw: OpenClaw: Tlon cite expansion happens before channel and DM authorization is complete GHSA-3W6X-GV34-MQPFHighopenclaw: OpenClaw's mutating internal ACP chat commands missed operator.admin scope enforcement CVE-2026-35652Mediumopenclaw: OpenClaw: Mattermost callback dispatch allowed non-allowlisted sender actions GHSA-PPWQ-6V66-5M6JMediumopenclaw: OpenClaw Exposes Credentials Embedded in baseUrl Fields via config.get and channels.status CVE-2026-35648Lowopenclaw: OpenClaw may have stale policy enforcement for queued node actions CVE-2026-35650Highopenclaw: OpenClaw has Inconsistent Host Exec Environment Override Sanitization GHSA-48VW-M3QC-WR99Highopenclaw: OpenClaw's Trusted-proxy Control UI sessions retain privileged scopes without device identity on device-less allow paths CVE-2026-35626Mediumopenclaw: OpenClaw is vulnerable to unauthenticated resource exhaustion through its voice call webhook handling CVE-2026-35659Mediumopenclaw: OpenClaw: Bonjour/DNS-SD TXT metadata steers CLI routing after failed service resolution CVE-2026-35633Highopenclaw: OpenClaw: Remote media error responses could trigger unbounded memory allocation before failure CVE-2026-35643Highopenclaw: OpenClaw: Arbitrary code execution via unvalidated WebView JavascriptInterface CVE-2026-35666Highopenclaw: OpenClaw's system.run allowlist can be bypassed through an unregistered time dispatch wrapper CVE-2026-35627Highopenclaw: OpenClaw: Nostr inbound DMs could trigger unauthenticated crypto work before sender policy enforcement CVE-2026-35670Mediumopenclaw: OpenClaw: Synology Chat reply delivery could be rebound through username-based user resolution.CVE-2026-34426Mediumopenclaw: OpenClaw: Windows media loaders accepted remote-host file URLs before local path validation CVE-2026-35660Highopenclaw: OpenClaw: Gateway agent /reset exposes admin session reset to operator.write callers CVE-2026-35634Mediumopenclaw: OpenClaw: Gateway Canvas local-direct requests bypass Canvas HTTP and WebSocket authentication CVE-2026-35618Highopenclaw: OpenClaw: Plivo V2 verified replay identity drifts on query-only variants CVE-2026-33864Criticalconvict: Convict has Prototype Pollution via startsWith() function CVE-2026-33863Criticalconvict: Convict has prototype pollution via load(), loadFile(), and schema initialization CVE-2026-33769Lowastro: Astro: Remote allowlist bypass via unanchored matchPathname wildcard CVE-2026-33768Medium@astrojs/vercel: Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path`CVE-2026-32846Highopenclaw: OpenClaw is vulnerable to Path Traversal through path validation bypass CVE-2026-33751Mediumn8n: n8n Vulnerable to LDAP Filter Injection in LDAP Node

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo