npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-65966High@oneuptime/common: OneUptime Unauthorized User Creation via API CVE-2025-66028Medium@oneuptime/common: OneUptime is Vulnerable to Privilege Escalation via Login Response Manipulation GHSA-4VCF-Q4XF-F48MHigh@better-auth/passkey: Better Auth Passkey Plugin allows passkey deletion through IDOR CVE-2025-13466Mediumbody-parser: body-parser is vulnerable to denial of service when url encoding is used CVE-2025-65944Medium@sentry/node: Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true`CVE-2025-63700Medium@clerk/clerk-js: Clerk-js vulnerable to bypass of OAuth authentication flow by manipulating request at OTP verification stage CVE-2025-64762High@workos-inc/authkit-nextjs: authkit-nextjs may let session cookies be cached in CDNs CVE-2025-64755High@anthropic-ai/claude-code: @anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes CVE-2025-13437Mediumzx: zx Uses Incorrectly-Resolved Name or Reference CVE-2025-65108Criticalmd-to-pdf: md-to-pdf vulnerable to arbitrary JavaScript code execution when parsing front matter CVE-2025-64767Critical@hpke/core: @hpke/core reuses AEAD nonces CVE-2025-60794Medium@perfood/couch-auth: @perfood/couch-auth may expose session tokens, passwords CVE-2025-65099High@anthropic-ai/claude-code: Claude Code vulnerable to command execution prior to startup trust dialog CVE-2025-65019Mediumastro: Astro Cloudflare adapter has Stored Cross-site Scripting vulnerability in /_image endpoint CVE-2025-64765Mediumastro: Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values CVE-2025-64764Highastro: Astro vulnerable to reflected XSS via the server islands feature CVE-2025-64757Lowastro: Astro Development Server has Arbitrary Local File Read GHSA-V5W9-PRXF-W882Highflowise: Flowise has Authentication Bypass Using Unprotected Registration Endpoint (/register)CVE-2025-64758Medium@dependencytrack/frontend: @dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via welcome message CVE-2025-64756Highglob: glob CLI: Command injection via -c/--cmd executes matches with shell:true GHSA-M8JR-FXQX-8XX6High@apollo/composition: Apollo Federation has Improper Enforcement of Access Control on Transitive Fields CVE-2025-64747Mediumdirectus: Directus is Vulnerable to Stored Cross-site Scripting CVE-2025-64746Mediumdirectus: Directus has Improper Permission Handling on Deleted Fields GHSA-FJH6-8679-9PCHHighflowise-ui: Flowise does not Prevent Bypass of Password Confirmation - Unverified Password Change GHSA-X39M-3393-3QP4Highflowise-ui: Flowise doesn't Prevent Bypass of Password Confirmation through Unverified Email Change (credentials)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.