npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-27203Highebay-mcp: eBay API MCP Server Affected by Environment Variable Injection GHSA-GQ3J-XVXP-8HRFLowhono: Hono added timing comparison hardening in basicAuth and bearerAuthCVE-2026-28479Highopenclaw: OpenClaw replaced a deprecated sandbox hash algorithmCVE-2026-28394Mediumopenclaw: OpenClaw has a Web Fetch DoS via unbounded response parsingCVE-2026-25940Highjspdf: jsPDF has a PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)CVE-2026-25755Highjspdf: jsPDF has a PDF Object Injection via Unsanitized Input in addJS MethodCVE-2026-25535Highjspdf: jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF DimensionsCVE-2026-27122Mediumsvelte: Svelte SSR does not validate dynamic element tag names in `<svelte:element>`CVE-2026-27121Mediumsvelte: Svelte affected by cross-site scripting via spread attributes in Svelte SSRCVE-2026-27119Mediumsvelte: Svelte affected by XSS in SSR `<option>` elementCVE-2026-27118Medium@sveltejs/adapter-vercel: Cache poisoning in @sveltejs/adapter-vercelCVE-2026-27013Highfabric: Fabric.js Affected by Stored XSS via SVG ExportCVE-2026-27009Mediumopenclaw: OpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injectionCVE-2026-27008Mediumopenclaw: OpenClaw hardened the skill download target directory validationCVE-2026-27007Mediumopenclaw: OpenClaw's sandbox config hash sorted primitive arrays and suppressed needed container recreationCVE-2026-27004Mediumopenclaw: OpenClaw session tool visibility hardening and Telegram webhook secret fallbackCVE-2026-27003Mediumopenclaw: OpenClaw: Telegram bot token exposure via logsCVE-2026-27002Highopenclaw: OpenClaw: Docker container escape via unvalidated bind mount config injectionCVE-2026-27001Highopenclaw: OpenClaw: Unsanitized CWD path injection into LLM promptsCVE-2026-27022Medium@langchain/langgraph-checkpoint-redis: RediSearch Query Injection in @langchain/langgraph-checkpoint-redisCVE-2026-26996Highminimatch: minimatch has a ReDoS via repeated wildcards with non-matching literal in patternCVE-2026-26318Highsysteminformation: Command Injection via Unsanitized `locate` Output in `versions()` — systeminformationCVE-2026-26280Highsysteminformation: Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js retry pathCVE-2026-26980Criticalghost: Ghost has a SQL injection in Content APICVE-2026-26974High@tygo-van-den-hurk/slyde: Improper Control of Generation of Code ('Code Injection') in @tygo-van-den-hurk/slyde

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo