npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-106105High@quasar/ssl-certificate: Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions CVE-2026-106106High@quasar/render-ssr-error: Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable CVE-2026-106107High@quasar/app-vite: Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained CVE-2026-106108Medium@quasar/app-vite: Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory CVE-2026-106109Medium@quasar/app-vite: Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories CVE-2026-106104Highquasar: Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server CVE-2026-106102Criticalquasar: Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()CVE-2026-106103High@quasar/icongenie: Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile CVE-2026-57449High@actual-app/sync-server: Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token CVE-2026-86540Highknowns: knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json CVE-2026-105855Highpayload: Payload didn't enforce field-level password update restrictions CVE-2026-105854Highpayload: Payload: ReDoS in Multipart Content-Type Validation CVE-2026-105849Highpayload: Payload vulnerable to API key disclosure through ordinary document reads CVE-2026-105850High@payloadcms/plugin-ecommerce: Payload Ecommerce has an order confirmation validation issue CVE-2026-105852Mediumpayload: Payload relationship-query authorization bypass CVE-2026-105853Highpayload: Payload: Token refresh and password reset responses may expose restricted user fields CVE-2026-105851Criticalpayload: Payload: Field access control bypass on auth collections CVE-2026-105848Medium@payloadcms/plugin-stripe: Payload: Insufficient Access Control in Stripe REST Proxy CVE-2026-105806High@payloadcms/plugin-mcp: Payload: Improper access control for MCP API keys CVE-2026-105844Critical@payloadcms/plugin-import-export: Payload: Prototype pollution in Payload Import Export plugin CVE-2026-105845Criticalpayload: Payload: SQL Injection in SQLite and Postgres CVE-2026-105846Mediumpayload: Payload: Untrusted redirect URL parameter exploit CVE-2026-105847Highpayload: Payload: Polymorphic join queries could disclose hidden fields CVE-2026-105804Mediumpayload: Payload: Password hashes use insufficient PBKDF2 iterations CVE-2026-105805Mediumpayload: Payload: Sort queries could expose protected field information

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo