npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2024-56734Highbetter-auth: Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint CVE-2024-56510Medium@marp-team/marp-core: Marp Core allows XSS by improper neutralization of HTML sanitization CVE-2024-56334Highsysteminformation: Systeminformation has command injection vulnerability in getWindowsIEEE8021x (SSID)CVE-2024-56331Mediumuptime-kuma: uptime-kuma vulnerable to Local File Inclusion (LFI) via Improper URL Handling in `Real-Browser` monitor CVE-2024-56159Highastro: Astro's server source code is exposed to the public if sourcemaps are enabled GHSA-M56H-5XX3-2JC2Lowjsii: Prototype pollution in jsii.configureCategories CVE-2024-56140Mediumastro: Atro CSRF Middleware Bypass (security.checkOrigin)CVE-2024-21548Mediumbun: Bun has an Application-level Prototype Pollution vulnerability in the runtime native API for Glo CVE-2024-51479Highnext: Next.js authorization bypass vulnerability CVE-2024-53866Mediumpnpm: pnpm no-script global cache poisoning via overrides / `ignore-scripts` evasion CVE-2024-55500Highwhistle: Avenwu Whistle Cross-Site Request Forgery (CSRF)CVE-2024-54152Criticalangular-expressions: Angular Expressions - Remote Code Execution when using locals CVE-2024-53441Highcookie-encrypter: Bit flip attack vulnerability in cookie-encrypter CVE-2024-54151Highdirectus: Directus allows unauthenticated access to WebSocket events and operations CVE-2024-53847Mediumtrix: Trix editor subject to XSS vulnerabilities on copy & paste CVE-2024-55565Mediumnanoid: Predictable results in nanoid generation when given non-integer values CVE-2024-52798Highpath-to-regexp: path-to-regexp contains a ReDoS CVE-2024-54128Medium@directus/app: Directus has an HTML Injection in Comment CVE-2024-51210Lowfirepad: Firepad allows insecure document access CVE-2024-54134High@solana/web3.js: Modified package published to npm, containing malware that exfiltrates private key material CVE-2024-53983Medium@backstage/plugin-scaffolder-node: Backstage Scaffolder plugin vulnerable to Server-Side Request Forgery CVE-2024-53900Highmongoose: Mongoose search injection vulnerability GHSA-Q849-WXRC-VQRPCriticalhull.js: hull.js Code Injection Vulnerability CVE-2024-52810Medium@intlify/shared: @intlify/shared Prototype Pollution vulnerability CVE-2024-52809Medium@intlify/core-base: vue-i18n has cross-site scripting vulnerability with prototype pollution

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.