npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-31997Highopenclaw: OpenClaw: system.run approvals did not bind PATH-token executable identity, enabling post-approval executable rebindCVE-2026-31989Highopenclaw: OpenClaw has web_search citation redirect SSRF via private-network-allowing policyGHSA-JR6X-2Q95-FH2GHighopenclaw: OpenClaw's authorization mismatch allowed write-scope agent runs to reach owner-only toolsGHSA-7XMQ-G46G-F8PVHighopenclaw: OpenClaw: Sandbox media TOCTOU could read files outside sandbox rootGHSA-X82F-27X3-Q89CHighopenclaw: OpenClaw's TOCTOU symlink race in writeFileWithinRoot could create or truncate files outside root boundariesCVE-2026-31999Criticalopenclaw: CpenClaw's ACPX Windows wrapper shell fallback allowed cwd injection in specific pathsGHSA-8M9V-XPGF-G99MMediumopenclaw: OpenClaw has an unauthorized sender bypass in its stop triggers and /models command authorizationCVE-2026-32048Mediumopenclaw: OpenClaw's sandboxed sessions_spawn now enforces sandbox inheritance for cross-agent spawnsCVE-2026-32066Mediumopenclaw: OpenClaw has unbounded memory growth in Zalo webhook via query-string key churn (unauthenticated DoS)GHSA-392F-GGF5-FP3CMediumopenclaw: OpenClaw: Unicode canonicalization drift in node metadata policy classification could broaden node allowlistsCVE-2026-32041Highopenclaw: OpenClaw: Browser control startup could continue unauthenticated after auth bootstrap failureCVE-2026-28794Critical@orpc/client: `@orpc/client` has Prototype Pollution via `StandardRPCJsonSerializer` DeserializationCVE-2026-27971Critical@builder.io/qwik: Qwik vulnerable to Unauthenticated RCE via server$ DeserializationCVE-2026-28787High@oneuptime/common: OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replayCVE-2026-28361Mediumnocodb: NocoDB Missing Ownership Validation in MCP Token OperationsCVE-2026-28396Mediumnocodb: NocoDB's Refresh Tokens Not Revoked on Password ResetCVE-2026-28360Lownocodb: NocoDB has Plaintext Storage of Shared View PasswordsCVE-2026-28359Mediumnocodb: NocoDB Vulnerable to Stored Cross-site Scripting via Rich Text FieldCVE-2026-28358Lownocodb: NocoDB Vulnerable to User Enumeration via Password Reset EndpointCVE-2026-28357Mediumnocodb: NocoDB has Stored Cross-site Scripting via Formula CellCVE-2026-2293High@nestjs/platform-fastify: Nest has a Fastify URL Encoding Middleware Bypass CVE-2026-3304Highmulter: Multer vulnerable to Denial of Service via incomplete cleanupCVE-2026-2359Highmulter: Multer vulnerable to Denial of Service via resource exhaustionGHSA-5C6J-R48X-RMVQHighserialize-javascript: Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()CVE-2026-2880High@fastify/middie: @fastify/middie has Improper Path Normalization when Using Path-Scoped Middleware

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo