npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-94543Mediumnext: Next.js has cache poisoning of SSG and ISR pages in self-hosted applications CVE-2026-94486Lownext: Next.js has information disclosure in development server's Model Context Protocol endpoint CVE-2026-94485Mediumnext: Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass CVE-2026-94484Mediumnext: Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service CVE-2026-94483Highnext: Next.js has Server-Side Request Forgery in Image Optimization CVE-2026-105856High@payloadcms/db-sqlite: Payload: SQL injection in SQLite/Postgres CVE-2026-105858Highpayload: Payload: Remote Code Execution through first-register CVE-2026-105860High@payloadcms/plugin-multi-tenant: Payload has a tenant authorization bypass in Multi-Tenant Plugin CVE-2026-105861Highpayload: Payload external upload trust validation issue CVE-2026-105862Highpayload: Payload: Bypassed sanitization of user uploaded SVGs CVE-2026-105864Medium@payloadcms/plugin-multi-tenant: @payloadcms/plugin-multi-tenant has a cross-tenant create issue CVE-2026-105865Highpayload: Payload: Incomplete validation during the upload file lifecycle CVE-2026-105866Mediumpayload: Payload: Unauthenticated account-lockout denial of service CVE-2026-105867High@payloadcms/storage-s3: Payload: Client uploads could overwrite S3 objects CVE-2026-105868Highpayload: Payload: Uploaded XML files could execute same-origin JavaScript CVE-2026-105857Critical@payloadcms/plugin-form-builder: Payload Form Builder has an RCE issue CVE-2026-105859Criticalpayload: Payload: Unauthorized update to collection documents CVE-2026-105863Criticalpayload: Payload authentication token field handling issue CVE-2026-105650Highghost: Ghost: Stored XSS via oEmbed Photo Responses CVE-2026-105651Highghost: Ghost: Stored XSS via Bookmark Card Images CVE-2026-105652Lowghost: Ghost: Password Hash Ordering Disclosure in Ghost Admin API CVE-2026-105675Highghost: Ghost: Invite Token Disclosure in Ghost Admin API CVE-2026-105676Mediumghost: Ghost: Path Traversal via Locale Setting CVE-2026-105677Highghost: Ghost: Remote Code Execution via Theme Translation Files CVE-2026-105678Mediumghost: Ghost: Editors Could Promote Staff Users to Their Own Role

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.