npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-25586Critical@nyariv/sandboxjs: @nyariv/sandboxjs has Sandbox Escape via Prototype Whitelist Bypass and Host Prototype PollutionCVE-2026-25574Mediumpayload: payload-preferences has Cross-Collection IDOR in Access Control (Multi-Auth Environments)CVE-2026-25544Critical@payloadcms/drizzle: @payloadcms/drizzle has SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite AdaptersCVE-2026-25520Critical@nyariv/sandboxjs: @nyariv/sandboxjs has a Sandbox Escape issueCVE-2025-68458Lowwebpack: webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behaviorCVE-2025-68157Lowwebpack: webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistenceCVE-2026-25533Mediumenclave-vm: Sandbox escape via infinite recursion and error objectsCVE-2026-25752Criticalfuxa-server: FUXA Unauthenticated Remote Arbitrary Device Tag WriteCVE-2026-25895Criticalfuxa-server: FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload APICVE-2026-25894Criticalfuxa-server: FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default ConfigurationCVE-2026-25751Criticalfuxa-server: FUXA Unauthenticated Exposure of Plaintext Database CredentialsCVE-2026-25893Criticalfuxa-server: FUXA Unauthenticated Remote Code Execution via Admin JWT MintingCVE-2026-25631Mediumn8n: n8n's domain allowlist bypass enables credential exfiltrationCVE-2026-25630Criticalsurvey-pdf: survey-pdf Upgraded jsPDF Version Due to Security VulnerabilityCVE-2026-25593Highopenclaw: OpenClaw vulnerable to Unauthenticated Local RCE via WebSocket config.applyCVE-2026-25536High@modelcontextprotocol/sdk: @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuseCVE-2026-25546High@coding-solo/godot-mcp: godot-mcp has Command Injection via unsanitized projectPathCVE-2026-25115Criticaln8n: n8n has a Python sandbox escapeCVE-2026-25056Criticaln8n: n8n Merge Node has Arbitrary File Write leading to RCECVE-2026-25055Highn8n: n8n Vulnerable to Arbitrary File Write on Remote Systems via SSH NodeCVE-2026-25054Highn8n: n8n Has Stored Cross-site Scripting via Markdown Rendering in Workflow UICVE-2026-25475Mediumopenclaw: OpenClaw Vulnerable to Local File Inclusion via MEDIA: Path ExtractionCVE-2026-25053Criticaln8n: n8n has OS Command Injection in Git NodeCVE-2026-25052Criticaln8n: n8n's Improper File Access Controls Allow Arbitrary File Read by Authenticated UsersCVE-2026-25051Highn8n: n8n's Improper CSP Enforcement in Webhook Responses May Allow Stored XSS

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo