npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-70610Mediumelectron: Electron: contextBridge object copy honors prototype setters CVE-2026-70609Mediumelectron: Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter CVE-2026-70608Highelectron: Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path CVE-2026-70607Mediumelectron: Electron: window.open features string controls some window options considered privileged CVE-2026-70606Mediumelectron: Electron: ProtocolResponse.url reuses the default session cache instead of the registering session CVE-2026-70605Mediumelectron: Electron: HTTP redirect followed into local file loader CVE-2026-70604Highelectron: Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads CVE-2026-70602Mediumelectron: Electron: Extension tab APIs operate across session boundaries CVE-2026-70603Mediumelectron: Electron: shell.openPath path validation bypass via embedded null byte CVE-2026-70601Highelectron: Electron: Context isolation bypass via Function.prototype.bind hijack CVE-2026-70600Lowelectron: Electron: Cross-origin iframe can position native autofill popup CVE-2026-70599Mediumelectron: Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin CVE-2026-70598Lowelectron: Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size CVE-2026-70597Mediumelectron: Electron: Parent process code-sign check is spoofable CVE-2026-53949Mediumghost: Ghost Content API filter bypass reveals private fields CVE-2026-70596Mediumghost: Ghost: Cross-Site Scripting in Feature Image Captions CVE-2026-70595Mediumghost: Ghost: Server-Side Request Forgery Mitigation Issue CVE-2026-59817Mediumghost: Ghost: Paid gift memberships obtainable at minimal cost via the donations feature CVE-2026-53947Mediumghost: Ghost: Member existence leak via magic link sign-in response CVE-2026-53950High@tryghost/activitypub: XSS in Ghost's ActivityPub client CVE-2026-70594Mediumghost: Ghost: Session Fixation in Ghost Admin CVE-2026-70593Mediumghost: Ghost: Theme Upload Path Traversal CVE-2026-70592Mediumghost: Ghost: Database Backup Path Traversal CVE-2026-70591Mediumghost: Ghost: Server-Side Request Forgery in Image Fetching CVE-2026-70590Mediumghost: Ghost: Blind Password Hash Disclosure in Ghost Admin API

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo