npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-69262Highpnpm: pnpm vulnerable to Command Injection via environment variable substitution CVE-2025-67364Highfast-filesystem-mcp: fast-filesystem-mcp has a Path Traversal vulnerability CVE-2025-9611High@playwright/mcp: Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server Tools CVE-2024-14020Lowcarbone: carbone Code Injection vulnerability CVE-2026-22032Mediumdirectus: Directus has open redirect in SAML CVE-2026-21877Criticaln8n: n8n Vulnerable to RCE via Arbitrary File Write CVE-2025-66648Highvega-functions: `vega-functions` vulnerable to Cross-site Scripting via `setdata` function CVE-2025-65110Highvega-selections: Vega XSS via expression abusing vlSelectionTuples function array map calls in environments with satisfactory function gadgets in the global…CVE-2025-67427Medium@evershop/evershop: evershop allows unauthenticated attackers to force server to initiate HTTP request via "GET /images" API CVE-2025-67419High@evershop/evershop: evershop allows unauthenticated attackers to exhaust application server's resources via "GET /images" API CVE-2026-0621High@modelcontextprotocol/sdk: Anthropic's MCP TypeScript SDK has a ReDoS vulnerability CVE-2026-73645Medium@openzeppelin/confidential-contracts: ERC7984ERC20Wrapper: once a wrapper is filled, subsequent wrap requests do not revert and result in loss of funds.CVE-2025-68428Criticaljspdf: jsPDF has Local File Inclusion/Path Traversal vulnerability CVE-2026-21440Critical@adonisjs/bodyparser: AdonisJS Path Traversal in Multipart File Handling CVE-2025-68620Criticalsignalk-server: Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling CVE-2025-69203Mediumsignalk-server: Signal K Server Vulnerable to Access Request Spoofing CVE-2025-68619Highsignalk-server: Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package CVE-2025-68273Mediumsignalk-server: Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints CVE-2025-68272Highsignalk-server: Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding CVE-2025-66398Criticalsignalk-server: Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)GHSA-G9JG-W8VM-G96VMediumtrix: Trix has a stored XSS vulnerability through its attachment attribute CVE-2025-69256Highserverless: serverless MCP Server vulnerable to Command Injection in list-projects tool CVE-2025-15284Mediumqs: qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion GHSA-XPHH-5V4R-R3RXHighpsitransfer: PsiTransfer has Zip Slip Path Traversal via TAR Archive Download CVE-2025-69202Mediumaxios-cache-interceptor: axios-cache-interceptor Vulnerable to Cache Poisoning via Ignored HTTP Vary Header

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.