npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-30048Medium@developer.notchatbot/webchat: NotChatbot WebChat has a stored cross-site scripting (XSS) vulnerabilityCVE-2026-33151Highsocket.io-parser: socket.io allows an unbounded number of binary attachmentsCVE-2026-33143Highoneuptime: OneUptime WhatsApp Webhook Missing Signature VerificationCVE-2026-33142Highoneuptime: OneUptime ClickHouse vulnerable to SQL Injection via unvalidated column identifiers in sort, select, and groupBy parametersGHSA-WR4H-V87W-P3R7Mediumh3: h3 has a Path Traversal via Percent-Encoded Dot Segments in serveStatic Allows Arbitrary File ReadCVE-2026-33131Highh3: h3 has a middleware bypass with one gadgetCVE-2026-33129Mediumh3: h3 has an observable timing discrepancy in basic auth utilsCVE-2026-33128Highh3: h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream FieldsGHSA-87V3-4CFP-CM76Medium@pdfme/schemas: Cross-Site Scripting (XSS) via SVG Schema innerHTML Injection in @pdfme/schemasGHSA-QQ9G-96V4-M3CJMedium@pdfme/schemas: Cross-Site Scripting (XSS) via Select Schema Option Value Injection in @pdfme/schemasGHSA-8MPM-Q7MH-8FVHHigh@capgo/cli: Capgo CLI: symlink-following local secret writes enable arbitrary file overwrite + world-readable credentials (0600 missing)CVE-2026-33060Medium@aborruso/ckan-mcp-server: SSRF in @aborruso/ckan-mcp-server via base_url allows access to internal networksCVE-2026-32763Highkysely: SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`.CVE-2026-32256Highmusic-metadata: music-metadata has an infinite loop vulnerability in ASF parserCVE-2026-33042Mediumparse-server: Parse Server affected by empty authData bypassing credential requirement on signupCVE-2026-33036Highfast-xml-parser: fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)CVE-2026-33011High@nestjs/platform-fastify: Nest Fastify HEAD Request Middleware BypassCVE-2026-32770Mediumparse-server: Parse Server LiveQuery subscription with invalid regular expression crashes serverCVE-2026-32742Mediumparse-server: Parse Server session creation endpoint allows overwriting server-generated session fieldsCVE-2026-32878Mediumparse-server: Parse Server vulnerable to schema poisoning via prototype pollution in deep copyCVE-2026-32886Highparse-server: Parse Server's Cloud function dispatch crashes server via prototype chain traversalCVE-2026-32943Lowparse-server: Parse Server has a password reset token single-use bypass via concurrent requestsCVE-2026-32944Highparse-server: Parse Server crash via deeply nested query condition operatorsCVE-2026-31938Criticaljspdf: jsPDF has HTML Injection in New Window pathsCVE-2026-31898Highjspdf: jsPDF has a PDF Object Injection via FreeText color

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo