npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-FPG4-JHQR-589CLow@sveltejs/kit: SvelteKit has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimental only)CVE-2026-32898Mediumopenclaw: OpenClaw ACP client has permission auto-approval bypass via untrusted tool metadataCVE-2026-4039Mediumopenclaw: OpenClaw: Skill env override host env injection via applySkillConfigEnvOverrides (defense-in-depth)CVE-2026-27638Medium@actual-app/sync-server: @actual-app/sync-server: Missing authorization in sync endpoints allows cross-user budget file access in multi-user modeCVE-2026-27970High@angular/core: Angular i18n vulnerable to Cross-Site ScriptingCVE-2026-26861Highclevertap-web-sdk: CleverTap Web SDK is vulnerable to DOM-based XSS via handleCustomHtmlPreviewPostMessageEvent functionCVE-2026-26862Highclevertap-web-sdk: CleverTap Web SDK is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessageCVE-2026-28363Criticalopenclaw: OpenClaw is vulnerable to validation bypass through GNU long-option abbreviations in allowlist modeGHSA-38C7-23HJ-2WGQMediumn8n: n8n has Webhook Forgery on Zendesk Trigger NodeGHSA-FVFV-PPW4-7H2WMediumn8n: n8n has a Guardrail Node BypassGHSA-JH8H-6C9Q-7GMWMediumn8n: n8n has an Authentication Bypass in its Chat Trigger NodeGHSA-VJF3-2GPJ-233VMediumn8n: n8n has an SSO Enforcement Bypass in its Self-Service Settings APICVE-2026-27959Highkoa: Koa has Host Header Injection via ctx.hostnameCVE-2026-27942Lowfast-xml-parser: fast-xml-parser has stack overflow in XMLBuilder with preserveOrderCVE-2026-27902Mediumsvelte: Svelte: XSS via HTML Comment Injection in SSR Error Boundary Hydration MarkersCVE-2026-27901Mediumsvelte: Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`CVE-2026-27903Highminimatch: minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segmentsCVE-2026-27904Highminimatch: minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressionsCVE-2026-27837Mediumdottie: dottie is vulnerable to Prototype Pollution bypass via non-first path segments in set() and transform()CVE-2026-56357Mediumn8n: n8n: Webhook Forgery on Github Webhook TriggerCVE-2026-56351Mediumn8n: n8n: SQL Injection in MySQL, PostgreSQL, and Microsoft SQL nodesCVE-2026-27818Highterriajs-server: TerriaJS-Server has a domain validation bypass vulnerability in its proxy allowlistCVE-2026-27148Highstorybook: Storybook Dev Server is Vulnerable to WebSocket HijackingCVE-2026-27804Criticalparse-server: Parse Server: Account takeover via JWT algorithm confusion in Google auth adapterCVE-2026-27795Medium@langchain/community: LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo