npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-25474Highopenclaw: OpenClaw has a Telegram webhook request forgery (missing `channels.telegram.webhookSecret`) → auth bypass CVE-2026-24764Lowopenclaw: OpenClaw Affected by Remote Code Execution via System Prompt Injection in Slack Channel Descriptions CVE-2026-29613Highopenclaw: OpenClaw has a webhook auth bypass when gateway is behind a reverse proxy (loopback remoteAddress trust)GHSA-56F2-HVWG-5743Highopenclaw: OpenClaw affected by SSRF in Image Tool Remote Fetch CVE-2026-28395Mediumopenclaw: OpenClaw's Chrome extension relay binds publicly due to wildcard treated as loopback CVE-2026-28470Highopenclaw: OpenClaw has an exec allowlist bypass via command substitution/backticks inside double quotes CVE-2026-28458Highopenclaw: OpenClaw's Browser Relay /cdp websocket is missing auth which could allow cross-tab cookie access CVE-2026-28391Highopenclaw: OpenClaw's Windows cmd.exe parsing may bypass exec allowlist/approval gating CVE-2026-28459Highopenclaw: OpenClaw has an arbitrary transcript path file write via gateway sessionFile GHSA-HV93-R4J3-Q65FHighopenclaw: OpenClaw Hook Session Key Override Enables Targeted Cross-Session Routing CVE-2026-28472Criticalopenclaw: OpenClaw's gateway connect could skip device identity checks when auth.token was present but not yet validated CVE-2025-69287Medium@bsv/sdk: BSV Blockchain SDK has an Authentication Signature Data Preparation Vulnerability GHSA-W5CR-2QHR-JQC5Mediumagents: Cloudflare Agents has a Reflected Cross-Site Scripting (XSS) vulnerability in AI Playground site GHSA-8WC6-VGRQ-X6CFMediumrenovate: Child processes spawned by Renovate incorrectly have full access to environment variables CVE-2026-26226Mediumbeautiful-mermaid: beautiful-mermaid contains an SVG attribute injection issue that can lead to cross-site scripting (XSS)CVE-2026-1721Mediumagents: Cloudflare Agents is Vulnerable to Reflected Cross-Site Scripting in the AI Playground's OAuth callback handler CVE-2026-26185Mediumdirectus: Directus Vulnerable to User Enumeration via Password Reset Timing Attack CVE-2025-56647Medium@farmfe/core: @farmfe/core is Missing Origin Validation in WebSocket CVE-2026-26063Highcedipay-core: CediPay Affected by Improper Input Validation in Payment Processing CVE-2026-2391Lowqs: qs's arrayLimit bypass in comma parsing allows denial of service CVE-2026-2327Mediummarkdown-it: markdown-it is has a Regular Expression Denial of Service (ReDoS)CVE-2026-0969Highnext-mdx-remote: next-mdx-remote affected by arbitrary code execution in React server-side rendering of untrusted MDX content CVE-2025-69873Mediumajv: ajv has ReDoS when using `$data` option CVE-2025-69874Mediumnanotar: nanotar is vulnerable to path traversal in parseTar() and parseTarGzip()CVE-2026-26021Criticalset-in: set-in Affected by Prototype Pollution

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo