npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2025-61927Criticalhappy-dom: Happy DOM: VM Context Escape can lead to Remote Code ExecutionCVE-2025-61925Mediumastro: Astro's `X-Forwarded-Host` is reflected without validationGHSA-J44M-5V8F-GC9CHighflowise: Flowise is vulnerable to arbitrary file exposure through its ReadFileToolCVE-2025-61928Highbetter-auth: Better Auth: Unauthenticated API key creation through api-key pluginGHSA-365G-VJW2-GRX8Highn8n-nodes-base: n8n: Execute Command Node Allows Authenticated Users to Run Arbitrary Commands on HostCVE-2025-61913Criticalflowise: Flowise is vulnerable to arbitrary file write through its WriteFileTool CVE-2025-61687Highflowise: FlowiseAI/Flosise has File Upload vulnerabilityCVE-2025-13033Mediumnodemailer: Nodemailer: Email to an unintended domain can occur due to Interpretation ConflictCVE-2025-11362Highpdfmake: pdfmake is vulnerable to Throttling via repeatedly redirecting URL in file embeddingCVE-2025-59159Criticalsillytavern: SillyTavern Web Interface Vulnerable DNS RebindingCVE-2025-55346Criticalflowise: Flowise vulnerable to RCE via Dynamic function constructor injectionCVE-2025-11287Medium@samanhappy/mcphub: MCPHub has an Improper Authorization vulnerability via its handleSseConnection functionCVE-2025-11285Low@samanhappy/mcphub: MCPHub's ServerController is vulnerable to Command InjectionCVE-2025-29192Mediumflowise: Flowise Stored XSS vulnerability through logs in chatbotCVE-2025-50538Criticalflowise: Flowise is vulnerable to stored XSS via "View Messages" allows credential theft in FlowiseAI admin panelGHSA-4FR9-3X69-36WVMediumflowise: Flowise vulnerable to XSSCVE-2025-59829Low@anthropic-ai/claude-code: Claude Code permission deny bypass through symlinkCVE-2025-59536High@anthropic-ai/claude-code: Claude Code can execute commands prior to the startup trust dialog CVE-2025-56515Lowfiora: Fiora chat group avatar is vulnerable to XSS via SVG filesCVE-2025-56514Lowfiora: Fiora chat user avatar is vulnerable to XSS via SVG filesCVE-2025-61668High@plone/volto: @plone/volto vulnerable to potential DoS by invoking specific URL by anonymous user CVE-2025-56200Mediumvalidator: validator.js has a URL validation bypass vulnerability in its isURL functionCVE-2025-56571Highfinancejs: Finance.js vulnerable to DoS via the IRR function’s depth parameterCVE-2025-56572Highfinancejs: Finance.js vulnerable to DoS via the seekZero() parameterCVE-2025-53967Highfigma-developer-mcp: figma-developer-mcp vulnerable to command injection in get_figma_data tool

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo