npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-59141Highsimple-swizzle: [email protected] contains malware after npm account takeover CVE-2025-59140Highbackslash: [email protected] contains malware after npm account takeover CVE-2025-59155Mediumhackmd-mcp: HackMD MCP Server has Server-Side Request Forgery (SSRF) vulnerability CVE-2025-9862Mediumghost: Ghost vulnerable to Server Side Request Forgery (SSRF) via oEmbed Bookmark CVE-2025-71336Criticalflowise: Flowise has unsandboxed remote code execution via Custom MCP CVE-2025-71334Criticalflowise: Flowise has arbitrary file access due to missing chat flow id validation GHSA-99PG-HQVX-R4GFCriticalflowise: Flowise has an Arbitrary File Read CVE-2025-59528Criticalflowise: Flowise has Remote Code Execution vulnerability CVE-2025-59527Highflowise: FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability CVE-2025-57164Criticalflowise: FlowiseAI Pre-Auth Arbitrary Code Execution CVE-2025-58177Mediumn8n: Stored XSS in n8n LangChain Chat Trigger Node via initialMessages Parameter GHSA-QJ3P-XC97-XW74Medium@metamask/sdk: MetaMask SDK indirectly exposed via malicious [email protected] dependency CVE-2025-59139Mediumhono: Hono has Body Limit Middleware Bypass CVE-2025-58434Criticalflowise: Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover CVE-2025-58754Highaxios: Axios is vulnerable to DoS attack through lack of data size check CVE-2025-59039Criticalprebid-universal-creative: Prebid-universal-creative latest on npm briefly compromised CVE-2025-59038Highprebid.js: Prebid.js NPM package briefly compromised CVE-2025-9910Mediumjsondiffpatch: jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin CVE-2025-59052High@angular/platform-server: Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage CVE-2025-59046Criticalinteractive-git-checkout: interactive-git-checkout has a Command Injection vulnerability CVE-2025-59041High@anthropic-ai/claude-code: Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email CVE-2025-57520Mediumdecap-cms: Decap CMS Cross Site Scripting (XSS) vulnerability CVE-2025-58765High@webrecorder/wabac: Webrecorder packages are vulnerable to XSS through 404 error handling logic CVE-2025-58764High@anthropic-ai/claude-code: Claude Code rg vulnerability does not protect against approval prompt bypass CVE-2025-58751Lowvite: Vite middleware may serve files starting with the same name with the public directory

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.