npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2024-53843Medium@dapperduckling/keycloak-connector-server: @dapperduckling/keycloak-connector-server has Reflected XSS Vulnerability in Authentication Flow URL Handling CVE-2024-32965High@lobehub/chat: @lobehub/chat Server Side Request Forgery vulnerability CVE-2024-53261Low@sveltejs/kit: @sveltejs/kit vulnerable to XSS on dev mode 404 page CVE-2024-53262Low@sveltejs/kit: @sveltejs/kit has unescaped error message included on error page GHSA-PQHP-25J4-6HQ9Mediumsmol-toml: smol-toml has a Denial of Service via malicious TOML document using deeply nested inline tables CVE-2024-58351Highflowise: Flowise OverrideConfig security vulnerability CVE-2024-11023Mediumfirebase: Firebase JavaScript SDK allows attackers to manipulate the "_authTokenSyncURL" to point to their own server CVE-2024-21539Low@eslint/plugin-kit: Regular Expression Denial of Service (ReDoS) in @eslint/plugin-kit CVE-2024-49362Highjoplin: Remote Code Execution on click of <a> Link in markdown preview CVE-2024-21541Mediumdom-iterator: dom-iterator code execution vulnerability CVE-2024-50336Mediummatrix-js-sdk: matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal CVE-2024-21538Highcross-spawn: Regular Expression Denial of Service (ReDoS) in cross-spawn CVE-2024-51434Mediumfroala-editor: Froala WYSIWYG editor allows cross-site scripting (XSS)CVE-2024-51757Criticalhappy-dom: happy-dom allows for server side code to be executed by a <script> tag CVE-2024-51753Low@workos-inc/authkit-remix: @workos-inc/authkit-remix refresh tokens are logged when the debug flag is enabled CVE-2024-51752Low@workos-inc/authkit-nextjs: @workos-inc/authkit-nextjs refresh tokens are logged when the debug flag is enabled CVE-2024-49770High@oakserver/oak: Path traversal in oak allows transfer of hidden files within the served root directory CVE-2024-42515Mediumglossarizer: Glossarizer Cross-site Scripting vulnerability CVE-2024-48910Criticaldompurify: DOMPurify vulnerable to tampering by prototype polution CVE-2024-21537Highlilconfig: lilconfig Code Injection vulnerability CVE-2024-10491Mediumexpress: Express ressource injection CVE-2024-7774Mediumlangchain: Langchain Path Traversal vulnerability CVE-2024-7042Low@langchain/community: @langchain/community SQL Injection vulnerability CVE-2024-50611Medium@cyclonedx/cdxgen: CycloneDX cdxgen may execute code contained within build-related files CVE-2020-26311Mediumuseragent: useragent Regular Expression Denial of Service vulnerability

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.