npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-46573Highpassport-wsfed-saml2: Passport-wsfed-saml2 allows SAML Authentication Bypass via Attribute Smuggling CVE-2025-46572Criticalpassport-wsfed-saml2: Passport-wsfed-saml2 allows SAML Authentication Bypass via Signature Wrapping GHSA-JQX4-9GPQ-RPPMMedium@misskey-dev/summaly: @misskey-dev/summaly allows IP Filter Bypass via Redirect CVE-2025-46720Low@keystone-6/core: Keystone has an unintended `isFilterable` bypass that can be used as an oracle to match hidden fields CVE-2025-46553Low@misskey-dev/summaly: @misskey-dev/summaly Redirect Filter Bypass CVE-2025-46332Mediumflags: Information Disclosure via Flags override link CVE-2025-4144Medium@cloudflare/workers-oauth-provider: @cloudflare/workers-oauth-provider PKCE bypass via downgrade attack CVE-2025-4143Medium@cloudflare/workers-oauth-provider: @cloudflare/workers-oauth-provider missing validation of redirect_uri on authorize endpoint CVE-2025-46565Mediumvite: Vite's server.fs.deny bypassed with /. for files under project root CVE-2025-27611Highbase-x: Homograph attack allows Unicode lookalike characters to bypass validation.CVE-2025-46344Medium@auth0/nextjs-auth0: Auth0 NextJS SDK v4 Missing Session Invalidation CVE-2025-0716Lowangular: AngularJS improperly sanitizes SVG elements GHSA-WFM2-RQ5G-F8V5Medium@account-kit/smart-contracts: @account-kit/smart-contracts Allowlist Module Bypass Vulnerability CVE-2025-46343Mediumn8n: n8n Vulnerable to Stored XSS through Attachments View Endpoint CVE-2025-46328Lowsnowflake-sdk: NodeJS Driver for Snowflake has race condition when checking access to Easy Logging configuration file CVE-2025-46653Lowformidable: Formidable relies on hexoid to prevent guessing of filenames for untrusted executable content GHSA-733V-P3H5-QPQ7Medium@escape.tech/graphql-armor-cost-limit: GraphQL Armor Cost-Limit Plugin Bypass via Introspection Query Obfuscation CVE-2025-43865Highreact-router: React Router allows pre-render data spoofing on React-Router framework mode CVE-2025-43864Highreact-router: React Router allows a DoS via cache poisoning by forcing SPA mode CVE-2025-43855High@trpc/server: tRPC 11 WebSocket DoS Vulnerability CVE-2025-1520High@posthog/plugin-server: PostHog Plugin Server SQL Injection Vulnerability CVE-2024-47829Mediumpnpm: pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting CVE-2025-32965Criticalxrpl: Compromised xrpl.js versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2 CVE-2025-43954Medium@quasar/quasar-ui-qmarkdown: QMarkdown Cross-Site Scripting (XSS) vulnerability CVE-2025-32792Highses: ses's global contour bindings leak into Compartment lexical scope

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.