npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-31875Highparse-server: Parse Server's MFA recovery codes not consumed after use CVE-2026-31872Highparse-server: Parse Server has a protected fields bypass via dot-notation in query and sort CVE-2026-31871Criticalparse-server: Parse Server vulnerable to SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL CVE-2026-31868Mediumparse-server: Parse Server vulnerable to stored XSS via file upload of HTML-renderable file types CVE-2026-56763Mediumhono: Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })CVE-2026-31856Criticalparse-server: Parse Server vulnerable to SQL injection via `Increment` operation on nested object field in PostgreSQL CVE-2026-31862Critical@siteboon/claude-code-ui: @siteboon/claude-code-ui is Vulnerable to Command Injection via Multiple Parameters CVE-2026-31829Highflowise: Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access CVE-2026-31828Mediumparse-server: Parse Server vulnerable to LDAP injection via unsanitized user input in DN and group filter construction CVE-2026-31800Highparse-server: Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes CVE-2026-30973Medium@appium/support: @appium/support has a Zip Slip arbitrary file write in its ZIP extraction CVE-2026-30972Mediumparse-server: Parse Server has a rate limit bypass via batch request endpoint CVE-2026-30967Highparse-server: Parse Server OAuth2 authentication adapter account takeover via identity spoofing CVE-2026-30966Criticalparse-server: Parse Server has role escalation and CLP bypass via direct `_Join` table write CVE-2026-30965Criticalparse-server: Parse Server vulnerable to session token exfiltration via `redirectClassNameForKey` query parameter CVE-2026-30962Highparse-server: Parse Server has a protected fields bypass via logical query operators CVE-2026-30951Highsequelize: Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type CVE-2026-30949Highparse-server: Parse Server missing audience validation in Keycloak authentication adapter CVE-2026-30948Highparse-server: Parse Server vulnerable to stored cross-site scripting (XSS) via SVG file upload CVE-2026-30947Highparse-server: Parse Server has a bypass of class-level permissions in LiveQuery CVE-2026-30946Highparse-server: Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API CVE-2026-30945Highstudiocms: StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service CVE-2026-30941Highparse-server: Parse Server has a NoSQL injection via token type in password reset and email verification endpoints CVE-2026-31861High@siteboon/claude-code-ui: @siteboon/claude-code-ui is Vulnerable to Shell Command Injection in Git Routes CVE-2026-31808Mediumfile-type: file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo