npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-27739Critical@angular/ssr: Angular SSR is vulnerable to SSRF and Header Injection via request handling pipelineCVE-2026-27738Medium@angular/ssr: Angular SSR has an Open Redirect via X-Forwarded-PrefixCVE-2026-27606Highrollup: Rollup 4 has Arbitrary File Write via Path TraversalCVE-2026-27699Criticalbasic-ftp: Basic FTP has Path Traversal Vulnerability in its downloadToDir() methodCVE-2026-27729Medium@astrojs/node: Astro has memory exhaustion DoS due to missing request body size limit in Server ActionsCVE-2026-27578Highn8n: n8n Vulnerable to Stored XSS via Various NodesCVE-2026-27577Criticaln8n: n8n: Expression Sandbox Escape Leads to RCECVE-2026-27498Criticaln8n: n8n has Arbitrary Command Execution via File Write and Git OperationsCVE-2026-27497Criticaln8n: n8n has Potential Remote Code Execution via Merge NodeCVE-2026-27495Criticaln8n: n8n has a Sandbox Escape in its JavaScript Task RunnerCVE-2026-27494Highn8n: n8n has Arbitrary File Read via Python Code Node Sandbox EscapeCVE-2026-27493Criticaln8n: n8n has Unauthenticated Expression Evaluation via Form NodeCVE-2026-27610Highparse-dashboard: Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only SessionsCVE-2026-27609Highparse-dashboard: Parse Dashboard is Missing CSRF Protection for its Agent EndpointCVE-2026-27608Criticalparse-dashboard: Parse Dashboard is Missing Authorization for its Agent EndpointCVE-2026-27702Criticalbudibase: Budibase: Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud)CVE-2026-27595Criticalparse-dashboard: Parse Dashboard has incomplete authentication on AI Agent endpointCVE-2026-22866Low@ensdomains/ens-contracts: ENS DNSSEC Oracle Vulnerable to RSA Signature Forgery via Missing PKCS#1 v1.5 Padding ValidationCVE-2026-27829Medium@astrojs/node: Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSizeCVE-2026-27728Critical@oneuptime/common: OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()CVE-2026-27700Highhono: Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfoCVE-2026-27597Critical@enclave-vm/core: @enclave-vm/core is vulnerable to Sandbox EscapeCVE-2026-27612Mediumrepostat: repostat: Reflected Cross-Site Scripting (XSS) via repo prop in RepoCardCVE-2026-27584Critical@actual-app/sync-server: ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpointsCVE-2026-27567Mediumpayload: Payload: Server-Side Request Forgery (SSRF) in External File URL Uploads

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo