npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-71381Mediumhono: Hono vulnerable to Vary Header Injection leading to potential CORS Bypass CVE-2025-62517Mediumrollbar: rollbar vulnerable to Prototype Pollution in merge()CVE-2025-62713High@kottster/server: Kottster app reinitialization can be re-triggered allowing command injection in development mode CVE-2025-62610Highhono: Hono Improper Authorization vulnerability CVE-2025-62595Mediumkoa: Koa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logic GHSA-VFFH-C9PQ-4CRHMediumuptime-kuma: Uptime Kuma Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read CVE-2025-62522Mediumvite: vite allows server.fs.deny bypass via backslash on Windows GHSA-XVP7-8VM8-XFXXMedium@actual-app/sync-server: Actual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbers CVE-2025-57325Lowrollbar: rollbar vulnerable to prototype pollution CVE-2025-62505Low@lobehub/chat: Lobe Chat vulnerable to Server-Side Request Forgery with native web fetch module CVE-2025-11849Mediummammoth: Mammoth is vulnerable to Directory Traversal CVE-2025-62427High@angular/ssr: Angular SSR has a Server-Side Request Forgery (SSRF) flaw CVE-2025-53092High@strapi/core: Strapi core vulnerable to sensitive data exposure via CORS misconfiguration CVE-2025-25298Medium@strapi/core: Strapi Password Hashing is Missing Maximum Password Length Validation CVE-2024-56143High@strapi/core: Strapi Allows Unauthorized Access to Private Fields via parms.lookup CVE-2025-3930Medium@strapi/strapi: Strapi is vulnerable to Insufficient Session Expiration CVE-2025-62410Criticalhappy-dom: happy-dom's `--disallow-code-generation-from-strings` is not sufficient for isolating untrusted JavaScript CVE-2025-62381Highsveltekit-superforms: `sveltekit-superforms` has Prototype Pollution in `parseFormData` function of `formData.js`CVE-2025-62380Lowmailgen: Mailgen has HTML Injection and XSS Filter Bypass in Plaintext Emails CVE-2025-62374Mediumparse: Parse Javascript SDK vulnerable to prototype pollution in `Parse.Object` and internal APIs CVE-2025-34267Highflowise: Flowise: Authenticated Command Execution and Sandbox Bypass via Puppeteer and Playwright Packages CVE-2025-62366Lowmailgen: Mailgen has HTML Injection and XSS Filter Bypass in Plaintext Emails CVE-2025-59288Highplaywright: Playwright downloads and installs browsers without verifying the authenticity of the SSL certificate CVE-2025-62378Mediumcommandkit: CommandKit has incorrect command name exposure in context object for message command aliases CVE-2025-11183Mediumqwc2: QGIS QWC2 Cross-Site Scripting vulnerability

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.