npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-31802Hightar: node-tar Symlink Path Traversal via Drive-Relative LinkpathCVE-2026-26801Highpdfmake: pdfmake is vulnerable to server-side request forgery (SSRF)CVE-2026-30837Highelysia: Elysia has a string URL format ReDoSCVE-2026-29793Critical@feathersjs/mongodb: Feathers has a NoSQL Injection via WebSocket id Parameter in MongoDB AdapterCVE-2026-29792Critical@feathersjs/authentication-oauth: Feathers has an OAuth Callback Account Takeover issueCVE-2026-28292Criticalsimple-git: simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCECVE-2026-26118HighAzure.Mcp: Azure MCP Server has Server-Side Request Forgery issue that allows authorized attacker to elevate privileges over a networkCVE-2026-31840Criticalparse-server: Parse Server: SQL injection via dot-notation field name in PostgreSQLCVE-2026-30944Highstudiocms: StudioCMS has Privilege Escalation via Insecure API Token GenerationCVE-2026-30959Medium@oneuptime/common: OneUptime has WhatsApp Resend Verification Authorization BypassCVE-2026-30957Critical@oneuptime/common: OneUptime has Synthetic Monitor RCE via exposed Playwright browser objectCVE-2026-30956Critical@oneuptime/common: OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header that leads to cross‑tenant data exposure and account…CVE-2026-30952Highliquidjs: liquidjs has a path traversal fallback vulnerabilityCVE-2026-3089Medium@actual-app/sync-server: Actual Sync Server has an Authenticated Path TraversalCVE-2026-30939Highparse-server: Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain ResolutionCVE-2026-30938Mediumparse-server: Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placementCVE-2026-30925Highparse-server: Parse Server has Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQueryCVE-2026-27646Mediumopenclaw: OpenClaw: Sandboxed /acp spawn requests could initialize host ACP sessionsGHSA-9Q2P-VC84-2RWMMediumopenclaw: OpenClaw: system.run allow-always persistence included shell-commented payload tailsGHSA-HFPR-JHPQ-X4RMMediumopenclaw: OpenClaw: `operator.write` chat.send could reach admin-only config writesCVE-2026-27183Lowopenclaw: OpenClaw: system.run wrapper-depth boundary could skip shell approval gatingCVE-2026-32913Highopenclaw: OpenClaw: fetch-guard forwards custom authorization headers across cross-origin redirectsGHSA-PJVX-RX66-R3FGMediumopenclaw: OpenClaw: Cross-account sender authorization expansion in `/allowlist ... --store` account scopingGHSA-3H2Q-J2V4-6W5RMediumopenclaw: OpenClaw's system.run allowlist approval parsing missed PowerShell encoded-command wrappersGHSA-J425-WHC4-4JGCMediumopenclaw: OpenClaw's `system.run` env override filtering allowed dangerous helper-command pivots

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo