npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-26319Highflowise: FlowiseAI Flowise arbitrary file upload vulnerability CVE-2025-27408Mediummanifest: Manifest Uses a One-Way Hash without a Salt CVE-2024-51091Lowseajs: seajs Cross-site Scripting vulnerability CVE-2024-53384Lowtsup: tsup DOM Clobbering vulnerability CVE-2024-53388Mediummavo: mavo DOM Clobbering vulnerability CVE-2024-53386Mediumstage-js: Stage.js DOM Clobbering vulnerabilty CVE-2024-53382Mediumprismjs: PrismJS DOM Clobbering vulnerability CVE-2025-1756Highmongosh: mongosh vulnerable to local privilege escalation CVE-2025-1691Highmongosh: MongoDB Shell may be susceptible to Control Character Injection via autocomplete CVE-2025-1692Mediummongosh: MongoDB Shell may be susceptible to control character injection via pasting CVE-2025-1693Lowmongosh: MongoDB Shell may be susceptible to control character Injection via shell output CVE-2025-27146Lowmatrix-appservice-irc: Matrix IRC Bridge allows IRC command injection to own puppeted user CVE-2025-27108Highdom-expressions: DOM Expressions has a Cross-Site Scripting (XSS) vulnerability due to improper use of string.replace CVE-2025-27109Highsolid-js: Solid Lacks Escaping of HTML in JSX Fragments allows for Cross-Site Scripting (XSS)GHSA-VP58-J275-797XHighbetter-auth: Better Auth allows bypassing the trustedOrigins Protection which leads to ATO CVE-2025-27143Mediumbetter-auth: Beter Auth has an Open Redirect via Scheme-Less Callback Parameter CVE-2025-1467Lowtarteaucitronjs: tarteaucitron Cross-site Scripting (XSS)CVE-2025-25299Medium@ckeditor/ckeditor5-real-time-collaboration: Cross-site scripting (XSS) in the CKEditor 5 real-time collaboration package CVE-2025-0868Criticaldocsgpt: DocsGPT Allows Remote Code Execution CVE-2025-27089Mediumdirectus: Directus allows updates to non-allowed fields due to overlapping policies CVE-2025-1302Highjsonpath-plus: JSONPath Plus allows Remote Code Execution CVE-2025-25290Medium@octokit/request: @octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking CVE-2025-25289Medium@octokit/request-error: @octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking CVE-2025-25288Medium@octokit/plugin-paginate-rest: @octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking CVE-2025-25285Medium@octokit/endpoint: @octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.