npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

GHSA-X7RP-QJ2H-GHGWHighflowise: Flowise Fails to Invalidate Existing Sessions After Password Changes CVE-2025-13204Highexpr-eval: expr-eval vulnerable to Prototype Pollution CVE-2025-64530High@apollo/composition: @apollo/composition has Improper Enforcement of Access Control on Interface Types and Fields CVE-2025-64718Mediumjs-yaml: js-yaml has prototype pollution in merge (<<)CVE-2025-64749Mediumdirectus: Directus Vulnerable to Information Leakage in Existing Collections CVE-2025-64748Mediumdirectus: Directus's conceal fields are searchable if read permissions enabled CVE-2025-64525Mediumastro: Astro vulnerable to URL manipulation via headers, leading to middleware and CVE-2025-61925 bypass CVE-2025-64745Lowastro: Astro development server error page is vulnerable to reflected Cross-site Scripting CVE-2025-59840Highvega-expression: Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global variable GHSA-8WJ8-CFXR-9374Highaws-advanced-nodejs-wrapper: AWS Advanced NodeJS Wrapper: Privilege Escalation in Aurora PostgreSQL instance CVE-2025-64502Mediumparse-server: Parse Server allows public `explain` queries which may expose sensitive database performance information and schema details CVE-2025-12613Highcloudinary: Cloudinary Node SDK is vulnerable to Arbitrary Argument Injection through parameters that include an ampersand CVE-2025-12919Low@evershop/evershop: EverShop is vulnerable to Unauthorized Order Information Access (IDOR)CVE-2025-64496Highopen-webui: Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events CVE-2025-64495Highopen-webui: Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE CVE-2025-48985Lowai: Vercel’s AI SDK's filetype whitelists can be bypassed when uploading files CVE-2025-52662Medium@nuxt/devtools: Nuxt DevTools vulnerable to cross-site scripting (XSS)CVE-2025-64430Highparse-server: Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format CVE-2025-12735Highexpr-eval: expr-eval does not restrict functions passed to the evaluate function CVE-2025-11953Critical@react-native-community/cli: @react-native-community/cli has arbitrary OS command injection CVE-2025-64118Mediumtar: node-tar has a race condition leading to uninitialized memory exposure CVE-2025-62726Highn8n: n8n Vulnerable to Remote Code Execution via Git Node Pre-Commit Hook CVE-2025-60542Hightypeorm: TypeORM vulnerable to SQL injection via crafted request to repository.save or repository.update GHSA-5JPX-9HW9-2FX4Mediumnext-auth: NextAuthjs Email misdelivery Vulnerability CVE-2025-59837Highastro: Astro's bypass of image proxy domain validation leads to SSRF and potential XSS

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.