npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

GHSA-6RMX-GVVG-VH6JMediumopenclaw: OpenClaw's hooks count non-POST requests toward auth lockout GHSA-RCHV-X836-W7XPHighopenclaw: OpenClaw's dashboard leaked gateway auth material via browser URL/query and localStorage CVE-2026-30863Criticalparse-server: Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters CVE-2026-30854Mediumparse-server: Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled CVE-2026-30850Mediumparse-server: Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization CVE-2026-30848Mediumparse-server: Parse Server: `PagesRouter` path traversal allows reading files outside configured pages directory CVE-2026-30920High@oneuptime/common: OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding CVE-2026-25041High@budibase/server: @budibase/server: Command Injection in PostgreSQL Dump Command CVE-2026-30921Critical@oneuptime/common: OneUptime: Synthetic Monitor RCE via exposed Playwright browser object GHSA-QR2G-P6Q7-W82MHigh@x402/svm: x402 SDK Security Advisory CVE-2025-69971High@frangoteam/fuxa: FUXA has a hardcoded fallback JWT signing secret CVE-2026-30887Critical@oneuptime/common: OneUpTime's Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE CVE-2026-30870Medium@powersync/service-core: PowerSync: Some sync filters ignored on 1.20.0 using `config.edition: 3`CVE-2026-30835Mediumparse-server: parse-server: Malformed `$regex` query leaks database error details in API response CVE-2026-30824Highflowise: Flowise Missing Authentication on NVIDIA NIM Endpoints CVE-2026-30823Highflowise: Flowise has IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration CVE-2026-30822Highflowise: Flowise Allows Mass Assignment in `/api/v1/leads` Endpoint CVE-2026-30821Highflowise: Flowise has Arbitrary File Upload via MIME Spoofing CVE-2026-30820Highflowise: Flowise has Authorization Bypass via Spoofed x-request-from Header CVE-2026-30241Lowmercurius: Mercurius's queryDepth limit bypassed for WebSocket subscriptions CVE-2026-30229Highparse-server: parse-server's endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user CVE-2026-30228Mediumparse-server: parse-server's file creation and deletion bypasses `readOnlyMasterKey` write restriction GHSA-9R75-G2CR-3H76Mediumworkflow: Vercel Workflow Allows Webhook Creation with Predictable User-Specified Tokens CVE-2026-30830Lowdefuddle: defuddle vulnerable to XSS via unescaped string interpolation in _findContentBySchemaText image tag CVE-2026-30827Highexpress-rate-limit: express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.