npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

GHSA-PFQ2-HH62-7M96Mediumrenovate: Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`CVE-2026-22785Critical@orval/mcp: orval MCP client is vulnerable to a code injection attack.CVE-2026-22704High@haxtheweb/haxcms-nodejs: HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover CVE-2025-68949Mediumn8n: n8n: Webhook Node IP Whitelist Bypass via Partial String Matching CVE-2026-0824Low@questdb/web-console: QuestDB UI's Web Console is Vulnerable to Cross-Site Scripting CVE-2026-22610High@angular/compiler: Angular has XSS Vulnerability via Unsanitized SVG Script Attributes GHSA-J965-2QGJ-VJMQLowaws-sdk: JavaScript SDK v2 users should add validation to the region parameter value in or migrate to v3 GHSA-6475-R3VJ-M8VFLow@smithy/config-resolver: AWS SDK for JavaScript v3 adopted defense in depth enhancement for region parameter value CVE-2026-22596Mediumghost: Ghost has SQL Injection in Members Activity Feed CVE-2026-22597Mediumghost: Ghost has SSRF via External Media Inliner CVE-2026-22595Highghost: Ghost has Staff Token permission bypass CVE-2025-14505Lowelliptic: Elliptic Uses a Cryptographic Primitive with a Risky Implementation CVE-2026-22594Highghost: Ghost has Staff 2FA bypass GHSA-96QW-H329-V5RGHighshakapacker: Shakapacker has environment variable leak via EnvironmentPlugin that exposes secrets to client-side bundles CVE-2026-22030Mediumreact-router: React Router has CSRF issue in Action/Server Action Request Processing CVE-2026-22029Highreact-router: React Router vulnerable to XSS via Open Redirects CVE-2026-21884Highreact-router: React Router SSR XSS in ScrollRestoration CVE-2025-68470Mediumreact-router: React Router has unexpected external redirect via untrusted paths CVE-2025-61686Critical@react-router/node: React Router has Path Traversal in File Session Storage CVE-2025-59057Highreact-router: React Router has XSS Vulnerability CVE-2026-22028Highpreact: Preact has JSON VNode Injection issue CVE-2026-21894Mediumn8n: n8n's Missing Stripe-Signature Verification Allows Unauthenticated Forged Webhooks CVE-2026-21858Criticaln8n: n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling CVE-2025-69264Highpnpm: pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"CVE-2025-69263Highpnpm: pnpm Has Lockfile Integrity Bypass that Allows Remote Dynamic Dependencies

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.