npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-32978Highopenclaw: OpenClaw: Unrecognized script runners could bypass `system.run` approval integrityGHSA-8JHH-JCQG-MJ5PMediumopenclaw: OpenClaw: Channel commands could bypass account-scoped `configWrites` restrictionsCVE-2026-32971Highopenclaw: OpenClaw: Node-host approvals could show misleading shell payloads instead of the executed argvCVE-2026-32979Highopenclaw: OpenClaw: Unbound interpreter and runtime commands could bypass node-host approval integrityGHSA-4W7M-58CG-CMFFHighopenclaw: OpenClaw: Leaf subagents could steer sibling sessions across sandbox boundariesGHSA-4JPW-HJ22-2XMCCriticalopenclaw: OpenClaw: Pairing-scoped device tokens could mint `operator.admin` and reach node RCECVE-2026-32916Criticalopenclaw: OpenClaw: Plugin subagent routes could bypass gateway authorization with synthetic admin scopesCVE-2026-32977Mediumopenclaw: OpenClaw: Sandbox `writeFile` commit could race outside the validated pathCVE-2026-32141Highflatted: flatted vulnerable to unbounded recursion DoS in parse() revive phaseCVE-2026-31882Highdagu: Dagu: SSE Authentication Bypass in Basic Auth ModeCVE-2026-26954Critical@nyariv/sandboxjs: SandboxJS affected by a Sandbox EscapeCVE-2026-32302Highopenclaw: OpenClaw: Untrusted web origins can obtain authenticated operator.admin access in trusted-proxy modeCVE-2026-29066Medium@tinacms/cli: TinaCMS CLI has Arbitrary File Read via Disabled Vite Filesystem RestrictionCVE-2026-28793High@tinacms/cli: TinaCMS Vulnerable to Path Traversal Leading to Arbitrary File Read, Write and DeleteCVE-2026-28792Critical@tinacms/cli: TinaCMS CLI Dev Server Vulnerable to Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMSCVE-2026-31841Mediumhyperterse: Hyperterse: Raw exposure of database statements in MCP search toolCVE-2026-28791Hightinacms: Tina: Path Traversal in Media Upload HandleCVE-2026-24125Medium@tinacms/graphql: @tinacms/graphql has a Path Traversal issueCVE-2026-32248Criticalparse-server: Parse Server: Account takeover via operator injection in authentication data identifierCVE-2026-32242Criticalparse-server: Parse Server's OAuth2 adapter shares mutable state across providers via singleton instanceCVE-2026-73426Mediumaction_text-trix: Trix has a Stored XSS vulnerability through serialized attributesGHSA-MWV9-GP5H-FRR4Lowdevalue: Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `__proto__` own propertiesCVE-2026-32234Mediumparse-server: Parse Server has a SQL injection via query field name when using PostgreSQLCVE-2026-32237Medium@backstage/plugin-scaffolder-backend: @backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpointCVE-2026-32236Low@backstage/plugin-auth-backend: @backstage/plugin-auth-backend: SSRF in experimental CIMD metadata fetch

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo