npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-8082Mediumvuetify: Vuetify has a Cross-site Scripting (XSS) vulnerability in the VDatePicker component CVE-2025-8083Highvuetify: Vuetify has a Prototype Pollution vulnerability CVE-2025-67750Highlightning-flow-scanner: Lightning Flow Scanner Vulnerable to Code Injection via Unsafe Use of `new Function()` in APIVersion Rule GHSA-5J59-XGG2-R9C4Highnext: Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up GHSA-C6M7-Q6PR-C64RMedium@vitejs/plugin-rsc: Vite Plugin React has a Source Code Exposure Vulnerability in React Server Components GHSA-CPQF-F22C-R95XHigh@vitejs/plugin-rsc: Vite Plugin React has a Denial of Service Vulnerability in React Server Components CVE-2025-67779Highreact-server-dom-parcel: Denial of Service Vulnerability in React Server Components GHSA-W37M-7FHW-FMV9Mediumnext: Next Server Actions Source Code Exposure GHSA-MWV6-3258-Q52CHighnext: Next Vulnerable to Denial of Service with Server Components CVE-2025-55184Highreact-server-dom-parcel: Denial of Service Vulnerability in React Server Components CVE-2025-55183Mediumreact-server-dom-parcel: Source Code Exposure Vulnerability in React Server Components CVE-2025-67731Highservify-express: Servify-express rate limit issue CVE-2025-67716Low@auth0/nextjs-auth0: Improper Validation of Query Parameters in Auth0 Next.js SDK CVE-2025-67490Medium@auth0/nextjs-auth0: Improper Request Caching Lookup in the Auth0 Next.js SDK CVE-2025-67718Highformio: Formio improperly authorized permission elevation through specially crafted request path CVE-2025-65513Mediummcp-fetch-server: Fetch MCP Server has a Server-Side Request Forgery (SSRF) vulnerability CVE-2025-14284Low@tiptap/extension-link: @tiptap/extension-link vulnerable to Cross-site Scripting (XSS)CVE-2025-13877Medium@nocobase/auth: Authentication Bypass via Default JWT Secret in NocoBase docker-compose Deployments CVE-2025-66457Highelysia: Elysia affected by arbitrary code injection through cookie config CVE-2025-66456Criticalelysia: Elysia vulnerable to prototype pollution with multiple standalone schema validation CVE-2025-67489Critical@vitejs/plugin-rsc: @vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development server CVE-2025-65849Mediumaltcha: Altcha Proof-of-Work obfuscation mode cryptanalytic break CVE-2025-65964Criticaln8n: n8n vulnerable to Remote Code Execution via Git Node Custom Pre-Commit Hook CVE-2025-66202Mediumastro: Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765 CVE-2025-65959Highopen-webui: Open WebUI Vulnerable to Stored DOM XSS via Note 'Download PDF'

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.