npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-28468Highopenclaw: OpenClaw has an authentication bypass in sandbox browser bridge server CVE-2026-28451Highopenclaw: OpenClaw has two SSRF via sendMediaFeishu and markdown image fetching in Feishu extension CVE-2026-29611Highopenclaw: OpenClaw has a LFI in BlueBubbles media path handling CVE-2026-27486Mediumopenclaw: OpenClaw: Process Safety - Unvalidated PID Kill via SIGKILL in Process Cleanup CVE-2026-28477Mediumopenclaw: OpenClaw Chutes manual OAuth state validation bypass can cause credential substitution CVE-2026-27487Highopenclaw: OpenClaw: Prevent shell injection in macOS keychain credential write CVE-2026-28462Highopenclaw: OpenClaw has a path traversal in browser trace/download output paths may allow arbitrary file writes CVE-2026-26972Mediumopenclaw: OpenClaw has a Path Traversal in Browser Download Functionality CVE-2026-28456Highopenclaw: OpenClaw affected by potential code execution via unsafe hook module path handling in Gateway CVE-2026-28482Highopenclaw: OpenClaw's unsanitized session ID enables path traversal in transcript file operations CVE-2026-26960Hightar: Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction GHSA-W5C7-9QQW-6645Highopenclaw: OpenClaw inter-session prompts could be treated as direct user instructions CVE-2026-29610Highopenclaw: OpenClaw: Command hijacking via unsafe PATH handling (bootstrapping + node-host PATH overrides)CVE-2026-28476Mediumopenclaw: OpenClaw affected by SSRF in optional Tlon (Urbit) extension authentication CVE-2026-29606Mediumopenclaw: OpenClaw Twilio voice-call webhook auth bypass when ngrok loopback compatibility is enabled CVE-2026-28480Mediumopenclaw: OpenClaw Telegram allowlist authorization accepted mutable usernames CVE-2026-28469Highopenclaw: OpenClaw Google Chat shared-path webhook target ambiguity allowed cross-account policy-context misrouting CVE-2026-26317Highopenclaw: OpenClaw affected by cross-site request forgery (CSRF) through loopback browser mutation endpoints CVE-2026-28478Highopenclaw: OpenClaw affected by denial of service via unbounded webhook request body buffering CVE-2026-28452Mediumopenclaw: OpenClaw affected by denial of service through unguarded archive extraction allowing high expansion/resource abuse (ZIP/TAR)CVE-2026-29612Mediumopenclaw: OpenClaw: denial of service through large base64 media files allocating large buffers before limit checks CVE-2026-29609Highopenclaw: OpenClaw affected by denial of service via unbounded URL-backed media fetch CVE-2026-28392Highopenclaw: OpenClaw Slack: dmPolicy=open allowed any DM sender to run privileged slash commands CVE-2026-28463Highopenclaw: OpenClaw exec approvals: safeBins could bypass stdin-only constraints via shell expansion CVE-2026-26323Highopenclaw: OpenClaw has a command injection in maintainer clawtributors updater

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo