npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2025-53626Medium@pdfme/common: @pdfme/common vulnerable to to XSS and Prototype Pollution through its expression evaluationCVE-2025-53364Mediumparse-server: Parse Server exposes the data schema via GraphQL APICVE-2025-53624Criticaldocusaurus-plugin-content-gists: docusaurus-plugin-content-gists vulnerability exposes GitHub Personal Access TokenCVE-2025-53620Critical@builder.io/qwik-city: Qwik's unhandled exception vulnerabilty can cause server crashes from malicious requestsCVE-2025-53548High@clerk/backend: @clerk/backend Performs Insufficient Verification of Data AuthenticityCVE-2025-6514Criticalmcp-remote: mcp-remote exposed to OS command injection via untrusted MCP server connectionsCVE-2025-53355Highmcp-server-kubernetes: MCP Server Kubernetes vulnerable to command injection in several toolsCVE-2025-59427Medium@cloudflare/vite-plugin: Cloudflare Vite plugin exposes secrets over the built-in dev serverCVE-2025-53372Highnode-code-sandbox-mcp: Node.js Sandbox MCP Server vulnerability can lead to Sandbox Escape via Command InjectionCVE-2025-53535Lowbetter-auth: Better Auth Open Redirect Vulnerability in originCheck Middleware Affects Multiple RoutesCVE-2025-49826Highnext: Next.JS vulnerability can lead to DoS via cache poisoning CVE-2025-49005Lownext: Next.js has a Cache poisoning vulnerability due to omission of the Vary headerCVE-2025-52554Mediumn8n: n8n is vulnerable to Improper Authorization through its `/stop` endpointCVE-2025-48939Mediumtarteaucitronjs: tarteaucitron.js vulnerable to DOM Clobbering via document.currentScriptCVE-2025-49595Mediumn8n: n8n Vulnerable to Denial of Service via Malformed Binary Data RequestsCVE-2025-53110High@modelcontextprotocol/server-filesystem: @modelcontextprotocol/server-filesystem vulnerability allows for path validation bypass via colliding path prefixCVE-2025-53109High@modelcontextprotocol/server-filesystem: @modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handlingCVE-2025-53107High@cyanheads/git-mcp-server: @cyanheads/git-mcp-server vulnerable to command injection in several toolsCVE-2024-46993Mediumelectron: Electron vulnerable to Heap Buffer Overflow in NativeImageCVE-2025-45143Lowstring-math: string-math's string-math.js vulnerability can cause Regex Denial of Service (ReDoS) CVE-2024-46992Highelectron: electron ASAR Integrity bypass by just modifying the contentCVE-2024-49365Hightiny-secp256k1: tiny-secp256k1 allows for verify() bypass when running in bundled environmentCVE-2024-49364Hightiny-secp256k1: tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled environmentGHSA-VH5J-5FHQ-9XWGLowtaylored: Taylor has race condition in /get-patch that allows purchase token replayCVE-2025-49592Mediumn8n: n8n allows open redirects via the /signin endpoint

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo