npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-106493Low@backstage/plugin-catalog-backend-module-azure: Backstage: Cloud storage catalog locations may cross configured storage boundaries CVE-2026-106491Medium@backstage/plugin-proxy-backend: Backstage: Improper input validation in proxy-backend CVE-2026-106492High@backstage/backend-defaults: Backstage: Improper preservation of access restrictions during service credential delegation CVE-2026-106494Medium@backstage/backend-defaults: Backstage: Improper input validation in cloud storage URL readers CVE-2026-106496Low@backstage/plugin-catalog-backend: Backstage: Inconsistent enforcement of allowed location types during catalog processing CVE-2026-106498High@backstage/plugin-catalog-backend: Backstage: Improper URL validation in catalog entity placeholder resolution CVE-2026-106501Critical@backstage/plugin-scaffolder-backend: Backstage: Sensitive information exposure in Scaffolder CVE-2026-106499Medium@backstage/plugin-scaffolder-backend: Backstage: Secret-derived values may be exposed in scaffolder task logs CVE-2026-106503High@backstage/plugin-scaffolder-backend: Backstage: Scaffolder action input authorization bypass CVE-2026-106500High@backstage/plugin-scaffolder-backend: Backstage: Improper task state validation in Scaffolder backend CVE-2026-106461Medium@backstage/plugin-scaffolder-backend: Backstage: Incorrect authorization in scaffolder task listing CVE-2026-106502Medium@backstage/plugin-scaffolder-backend: Backstage may expose sensitive information in Scaffolder task failure events CVE-2026-106504Medium@backstage/plugin-scaffolder-backend: Backstage has sensitive information exposure in scaffolder task logs CVE-2026-106506Medium@backstage/plugin-scaffolder-backend: Backstage has improper input validation in scaffolder task list ordering CVE-2026-106505High@backstage/plugin-techdocs-node: Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend CVE-2026-106508Medium@backstage/plugin-techdocs-node: Backstage has potential file exposure through local TechDocs publisher CVE-2026-106509High@backstage/plugin-techdocs-node: Backstage: Improper validation of MkDocs theme configuration in TechDocs CVE-2026-106557High@backstage/plugin-techdocs-node: Backstage has improper input validation in TechDocs Markdown extension configuration CVE-2026-106100High@payloadcms/db-mongodb: Payload: Field-level write access bypass in Payload on MongoDB CVE-2026-106120Mediumliquidjs: LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index,…CVE-2026-105681Mediumghost: Ghost: Authorization Bypass in Comments Feature CVE-2026-105682Lowghost: Ghost: Server-Side Request Forgery in Webhook Trigger CVE-2026-105683Lowghost: Ghost: Path Traversal Vulnerability in Ghost ImageSize Service CVE-2026-73487Criticalflowise: Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass CVE-2026-73483Criticalflowise: Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo