npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-32918Highopenclaw: `OpenClaw: session_status` let sandboxed subagents access parent or sibling session stateCVE-2026-32920Highopenclaw: OpenClaw: Workspace plugin auto-discovery allowed code execution from cloned repositoriesGHSA-R7VR-GR74-94P8Highopenclaw: OpenClaw: Command-authorized non-owners could reach owner-only `/config` and `/debug` surfacesGHSA-F8R2-VG7X-GH8MMediumopenclaw: OpenClaw: Exec approval allowlist patterns overmatched on POSIX pathsGHSA-M69H-JM2F-2PV8Mediumopenclaw: OpenClaw: Feishu reaction events could bypass group authorization and mention gatingGHSA-VMHQ-CQM9-6P7QHighopenclaw: OpenClaw: `browser.request` let `operator.write` persist admin-only browser profile changesGHSA-7H7G-X2PX-94HJMediumopenclaw: OpenClaw: Pairing setup codes exposed long-lived shared gateway credentials instead of short-lived bootstrap tokensGHSA-F5MF-3R52-R83WMediumopenclaw: OpenClaw's Zalouser allowlist authorization matched mutable group names by defaultCVE-2026-32621Critical@apollo/federation-internals: Apollo Federation vulnerable to prototype pollution via incomplete key sanitizationCVE-2026-1526Highundici: Undici has Unbounded Memory Consumption in WebSocket permessage-deflate DecompressionCVE-2026-2229Highundici: Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits ValidationCVE-2026-1527Mediumundici: Undici has CRLF Injection in undici via `upgrade` optionCVE-2026-2581Mediumundici: Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoSCVE-2026-1528Highundici: Undici: Malicious WebSocket 64-bit length overflows parser and crashes the clientCVE-2026-1525Mediumundici: Undici has an HTTP Request/Response Smuggling issueCVE-2026-32598Mediumoneuptime: OneUptime: Password Reset Token Logged at INFO LevelCVE-2026-32594Mediumparse-server: Parse Server's GraphQL WebSocket endpoint bypasses security middlewareCVE-2026-32269Mediumparse-server: Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpointCVE-2026-32308Highoneuptime: OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose")CVE-2026-32306Criticaloneuptime: OneUptime ClickHouse SQL Injection via Aggregate Query ParametersGHSA-9VVH-2768-C8VPMediumopenclaw: OpenClaw: Discord guild reaction ingress could bypass users and roles allowlistsCVE-2026-32304Criticallocutus: Locutus vulnerable to RCE via unsanitized input in create_function()CVE-2026-32970Lowopenclaw: OpenClaw: Unavailable local auth SecretRefs could fall through to remote credentials in local modeGHSA-MJ4P-RC52-M843Highopenclaw: OpenClaw: Sandbox staged writes could escape the verified parent directory before commitGHSA-JF6W-M8JW-JFXCMediumopenclaw: OpenClaw: Write-scoped callers could reach admin-only session reset logic through `agent`

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo