npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-105679Highghost: Ghost: Stored XSS via File Uploads on Local Storage CVE-2026-106457Medium@backstage/plugin-auth-backend-module-cloudflare-access-provider: Backstage: Insufficient audience validation in the Cloudflare Access auth provider CVE-2026-106455High@backstage/plugin-techdocs-node: Backstage: Improper validation of MkDocs plugin configuration in TechDocs CVE-2026-106456Medium@backstage/plugin-proxy-backend: Backstage: Inconsistent credential enforcement for overlapping proxy routes CVE-2026-106458Medium@backstage/plugin-catalog-backend-module-bitbucket-server: Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates CVE-2026-106459High@backstage/plugin-scaffolder-backend-module-sentry: Backstage: Improper input validation in Sentry scaffolder actions CVE-2026-106460Medium@backstage/plugin-auth-node: Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization CVE-2026-106101Lowquasar: Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service CVE-2026-105680Mediumghost: Ghost: Authorization Issue Allowed Author Role to Delete any Post CVE-2026-93605Criticalvm2: vm2 contains a sandbox escape vulnerability CVE-2026-104891High@insumermodel/mppx-condition-gate: mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control CVE-2026-106510High@backstage/plugin-techdocs-node: Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml CVE-2026-106558High@backstage/plugin-techdocs-node: Backstage: Improper validation of TechDocs MkDocs configuration CVE-2026-106559Medium@backstage/plugin-scaffolder-backend-module-confluence-to-markdown: Backstage: Improper input validation in Confluence to Markdown scaffolder module CVE-2026-106560High@backstage/plugin-scaffolder-backend-module-confluence-to-markdown: Backstage: Improper repository path validation in a Scaffolder backend module CVE-2026-106562Medium@backstage/plugin-search-backend: Backstage has incorrect authorization in search engine permission filtering CVE-2026-106563Medium@backstage/plugin-kubernetes-backend: Backstage: Improper entity validation in deprecated Kubernetes services endpoint CVE-2026-106561Medium@backstage/plugin-kubernetes-backend: Backstage has a sensitive information disclosure in Kubernetes resource queries CVE-2026-106462Medium@backstage/plugin-scaffolder-backend: Backstage's scaffolder credential handling may allow unintended GitHub authentication fallback CVE-2026-106463Medium@backstage/plugin-catalog-backend-module-gitlab: Backstage has improper authorization in GitLab organizational user ingestion CVE-2026-106486High@backstage/plugin-scaffolder-backend-module-bitbucket-cloud: Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions CVE-2026-106487Low@backstage/plugin-kubernetes-backend: Backstage: Unsupported catalog cluster authentication mode in kubernetes backend CVE-2026-106488High@backstage/plugin-auth-backend-module-oidc-provider: Backstage: Improper authentication in the OIDC provider CVE-2026-106489Medium@backstage/plugin-techdocs-backend: Backstage: Improper authorization enforcement for TechDocs static content CVE-2026-106490Medium@backstage/plugin-techdocs-backend: Backstage: Improper input validation in TechDocs static content requests

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo