npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-32235Medium@backstage/plugin-auth-backend: @backstage/plugin-auth-backend: OAuth redirect URI allowlist bypassCVE-2026-32106Mediumstudiocms: StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin AccountsCVE-2026-32104Mediumstudiocms: StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's SettingsCVE-2026-32103Mediumstudiocms: StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link GenerationCVE-2026-32101High@studiocms/s3-storage: StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth CheckCVE-2026-32230Mediumuptime-kuma: Uptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status pageCVE-2026-32031Mediumopenclaw: OpenClaw: /api/channels gateway-auth boundary bypass via path canonicalization mismatchCVE-2026-32895Mediumopenclaw: OpenClaw: Slack system events bypass sender authorization in member and message subtype handlersGHSA-QCC4-P59M-P54MHighopenclaw: OpenClaw: Sandbox dangling-symlink alias handling could bypass workspace-only write boundaryCVE-2026-32055Highopenclaw: OpenClaw: workspace path guard bypass on non-existent out-of-root symlink leafGHSA-GP3Q-WPQ4-5C5HHighopenclaw: OpenClaw: LINE group allowlist scope mismatch with DM pairing-store entriesCVE-2026-34506Mediumopenclaw: OpenClaw's MS Teams sender allowlist bypass when route allowlist is configured and sender allowlist is emptyCVE-2026-33574Mediumopenclaw: OpenClaw's skills-install-download can be redirected outside the tools root by rebinding the validated base pathCVE-2026-32921Mediumopenclaw: OpenClaw's system.run approvals did not bind mutable script operands across approval and executionCVE-2026-32098Mediumparse-server: Parse Server has a protected fields bypass via LiveQuery subscription WHERE clauseCVE-2026-31873Lowunhead: Unhead Vulnerable to Bypass of URI Scheme Sanitization in makeTagSafe via Case-SensitivityCVE-2026-31860Mediumunhead: Unhead has XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol checkCVE-2026-30226Mediumdevalue: devalue has prototype pollution in devalue.parse and devalue.unflattenCVE-2026-2366Low@keycloak/keycloak-admin-client: Keycloak vulnerable to authorization bypass via the Admin APICVE-2026-31988Mediumyauzl: yauzl contains an off-by-one errorCVE-2026-3965Low@whyour/qinglong: @whyour/qinglong: manipulation of the argument command leads to protection mechanism failureCVE-2026-32094Mediumshescape: Shescape escape() leaves bracket glob expansion active on Bash, BusyBox, and DashCVE-2026-31839High@striae-org/striae: Striae has a hash validation utility vulnerabilityCVE-2026-31975High@siteboon/claude-code-ui: @siteboon/claude-code-ui Vulnerable to Unauthenticated RCE via WebSocket Shell InjectionCVE-2026-31901Mediumparse-server: Parse Server vulnerable to user enumeration via email verification endpoint

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo