npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-72GR-QFP7-VWHWMediumh3: h3: Double Decoding in `serveStatic` Bypasses `resolveDotSegments` Path Traversal Protection via `%252e%252e`CVE-2026-33468Highkysely: Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that append string…CVE-2026-33442Highkysely: Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys.CVE-2026-33429Mediumparse-server: Parse Server has a protected field change detection oracle via LiveQuery watch parameterGHSA-PGX6-7JCQ-2QFFMedium@pdfme/common: PDFME has SSRF via Unvalidated URL Fetch in `getB64BasePdf` When `basePdf` Is Attacker-ControlledGHSA-XGX4-2WGV-4JHMMedium@pdfme/schemas: PDFME has XSS via Unsanitized i18n Label Injection into innerHTML in multiVariableText propPanelGHSA-VRQM-GVQ7-RRWHMedium@pdfme/pdf-lib: PDFME Affected by Decompression Bomb in FlateDecode Stream Parsing Causes Memory Exhaustion DoSCVE-2026-33421Highparse-server: Parse Server's LiveQuery bypasses CLP pointer permission enforcementCVE-2026-33418High@dicebear/converter: SVG Dimension Capping Bypass via XML Comment Injection in @dicebear/converter ensureSize()CVE-2026-32887Higheffect: Effect `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPCCVE-2026-33331High@orpc/openapi: oRPC has Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringifyCVE-2026-32701High@builder.io/qwik-city: Qwik City has array method pollution in FormData processing allows type confusion and DoSCVE-2026-33409Highparse-server: Parse Server has an auth provider validation bypass on login via partial authDataCVE-2026-33397Medium@angular/ssr: Protocol-Relative URL Injection via Single Backslash Bypass in Angular SSRCVE-2026-33349Mediumfast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parserCVE-2026-33326Medium@keystone-6/core: @keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany (CVE-2025-46720 incomplete fix)CVE-2026-33323Mediumparse-server: Parse Server email verification resend page leaks user existenceCVE-2026-33311Medium@dicebear/core: SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initialsCVE-2026-33228Highflatted: Prototype Pollution via parse() in NodeJS flattedGHSA-WVR4-3WQ4-GPC5Criticalmcp-bridge: MCP Connect has unauthenticated remote OS command execution via /bridge endpointCVE-2026-33068High@anthropic-ai/claude-code: Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings FileCVE-2026-33226Highbudibase: Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query PreviewCVE-2026-33163Highparse-server: Parse Server leaks protected fields via LiveQuery afterEvent triggerCVE-2026-32731Critical@apostrophecms/import-export: ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip ExtractionCVE-2026-32730Highapostrophe: ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo