npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2024-53615Mediumfiles.photo.gallery: files.photo.gallery command injection CVE-2025-24791Mediumsnowflake-sdk: snowflake-sdk may incorrectly validate temporary credential cache file permissions GHSA-R5W7-F542-Q2J4Low@sentry/node: Potential DoS when using ContextLines integration CVE-2025-24361Medium@nuxt/webpack-builder: Opening a malicious website while running a Nuxt dev server could allow read-only access to code CVE-2025-24360Medium@nuxt/vite-builder: Opening a malicious website while running a Nuxt dev server could allow read-only access to code CVE-2024-57041Mediumnodebb: NodeBB Cross-site scripting (XSS) vulnerability CVE-2024-57556Mediumstore2: Cross Site Scripting vulnerability in store2 CVE-2024-6533Lowdirectus: Directus has a DOM-Based cross-site scripting (XSS) via layout_options CVE-2025-24353Mediumdirectus: Directus allows privilege escalation using Share feature CVE-2025-24033High@fastify/multipart: Unlimited consumption of resources in @fastify/multipart CVE-2025-29049Mediummathlive: MathLive's Lack of Escaping of HTML allows for XSS CVE-2025-22150Mediumundici: Use of Insufficiently Random Values in undici CVE-2025-24012MediumUmbraco.Cms.StaticAssets: XSS/HTML Injection Vulnerability in Umbraco Backoffice Components CVE-2025-23221Medium@fedify/fedify: Infinite loop and Blind SSRF found inside the Webfinger mechanism in @fedify/fedify CVE-2025-24010Mediumvite: Websites were able to send any requests to the development server and read the response in vite CVE-2025-23207Mediumkatex: KaTeX \htmlData does not validate attribute names CVE-2025-23206Lowaws-cdk-lib: AWS Cloud Development Kit (AWS CDK) IAM OIDC custom resource allows connection to unauthorized OIDC provider CVE-2024-48460Hightabby-ssh: Eugeny Tabby Sends Password Despite Host Key Verification Failure CVE-2024-36751Mediumparse-uri: parse-uri Regular expression Denial of Service (ReDoS)CVE-2025-23061Criticalmongoose: Mongoose search injection vulnerability GHSA-M9C9-MC2H-9WJWLow@lodestar/reqresp: Lodestar snappy checksum issue GHSA-53RV-HCVM-RPP9Low@lodestar/reqresp: Lodestar snappy decompression issue CVE-2024-56332Mediumnext: Next.js Allows a Denial of Service (DoS) with Server Actions CVE-2025-21610Mediumtrix: Trix allows Cross-site Scripting via `javascript:` url in a link CVE-2024-56198Criticalpath-sanitizer: path-sanitizer allows bypassing the existing filters to achieve path-traversal vulnerability

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.