npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-119198Medium@nuxt/vite-builder: Nuxt dev server arbitrary file read through client error reportsCVE-2026-119199Medium@nuxt/vite-builder: Nuxt dev server exposes private runtime config through the Nitro dev bundleCVE-2026-118763High@sigstore/oci: @sigstore/oci sends the registry Authorization header to a cross-host blob-upload LocationCVE-2026-116689Highfollow-redirects: follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirectsGHSA-7WPF-CH8F-5F4XMediumsignalk-server: signalk-server has SSRF via absolute signalk.appIcon URL in the app store icon fetcherGHSA-4XM8-RG9H-JHQ2Criticalsignalk-server: Signal K resources API path traversal can disclose the JWT signing secret and enable remote code executionCVE-2026-119282High@nx/maven: @nx/maven and @nx/gradle have OS command injection via nx.json plugin optionsCVE-2026-118664Highdecode-uri-component: decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runsCVE-2026-118662Mediumvite: Vite: `server.fs.deny` bypassed with queriesGHSA-W9X9-J56R-H98RHigh@eeacms/volto-chatbot: @eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy ProxyGHSA-C33X-VCV4-VG3GLowcedar-policy: Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergenceCVE-2026-62264High@sylphx/pdf-reader-mcp: @sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEYCVE-2026-61448Lowparse-server: Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklistCVE-2026-116576Highsysteminformation: systeminformation vulnerable to Windows command injection in services() through Unicode quotation marksCVE-2026-115923Medium@backstage/plugin-catalog-backend: Backstage catalog rules can be bypassed for URL locations using encoded path segmentsGHSA-JF75-Q64Q-G65RMedium@waline/vercel: Waline login accepts a non-string email as a match-all MongoDB queryCVE-2026-116583Mediumseroval: Seroval: Code injection through a typed array's own constructor propertyCVE-2026-116582Mediumseroval: Seroval: Script injection through RegExp sources in serialized outputCVE-2026-116581Highseroval: Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)CVE-2026-116584Highseroval: Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node lengthCVE-2026-116580Highseroval: Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type checkCVE-2026-116575Mediummem0ai: Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)CVE-2026-116673Lowsysteminformation: systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/netCVE-2026-116674Mediumsysteminformation: systeminformation has prototype pollution in `networkStats()` via the interface nameCVE-2026-115887Highgraphql-scalars: graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo