npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-54369Criticalnode-saml: Node-SAML SAML Authentication Bypass CVE-2025-8020Highprivate-ip: private-ip vulnerable to Server-Side Request Forgery CVE-2025-8021Highfiles-bucket-server: files-bucket-server vulnerable to Directory Traversal CVE-2025-54139Medium@haxtheweb/haxcms-nodejs: HAX CMS application pages vulnerable to clickjacking CVE-2025-54137High@haxtheweb/haxcms-nodejs: NodeJS version of the HAX CMS application is distributed with Default Secrets CVE-2025-54134High@haxtheweb/haxcms-nodejs: HAX CMS NodeJS Application Has Improper Error Handling That Leads to Denial of Service CVE-2025-54128High@haxtheweb/haxcms-nodejs: NodeJS version of HAX CMS Has Disabled Content Security Policy That Enables Cross-Site Scripting CVE-2025-54127Critical@haxtheweb/haxcms-nodejs: NodeJS version of HAX CMS Has Insecure Default Configuration That Leads to Unauthenticated Access CVE-2025-7783Criticalform-data: form-data uses unsafe random function in form-data for choosing boundary GHSA-56R6-CCM5-8HG3High@account-kit/smart-contracts: Alchemy Non-SMA and Webauthn Account Security Advisory CVE-2025-53832High@translated/lara-mcp: @translated/lara-mcp vulnerable to command injection in import_tmx tool CVE-2025-54075High@nuxtjs/mdc: Nuxt MDC has an XSS vulnerability in markdown rendering that bypasses HTML filtering CVE-2025-54313Higheslint-config-prettier: eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code GHSA-XFFM-G5W8-QVG7Low@eslint/plugin-kit: @eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser CVE-2025-54070Medium@openzeppelin/contracts: OpenZeppelin Contracts Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffers CVE-2025-7339Lowon-headers: on-headers is vulnerable to http response header manipulation CVE-2025-7338Highmulter: Multer vulnerable to Denial of Service via unhandled exception from malformed request CVE-2025-54066Medium@dirac-grid/diracx-web-components: DiracX-Web is vulnerable to attack through an Open Redirect on its login page CVE-2025-53892Mediumvue-i18n: vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes CVE-2025-53818High@sunwood-ai-labs/github-kanban-mcp-server: GitHub Kanban MCP Server vulnerable to Command Injection CVE-2025-53889Mediumdirectus: Directus' insufficient permission checks can enable unauthenticated users to manually trigger Flows CVE-2025-53887Mediumdirectus: Directus' exact version number is exposed by the OpenAPI Spec CVE-2025-53886Mediumdirectus: Directus tokens are not redacted in flow logs, exposing session credentials to all admin CVE-2025-53885Mediumdirectus: Directus is vulnerable to sensitive data exposure as user data is not being redacted when logged GHSA-HQ75-XG7R-RX6CMediumbetter-call: Better Call routing bug can lead to Cache Deception

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.