npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-55663Mediummediasoup: mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)CVE-2026-55596High@platejs/media: Plate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScriptCVE-2026-55557Highbrowse-mcp: browse-mcp has an arbitrary file write via unconfined download and state pathsCVE-2026-55553Highurllib: urllib's cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakageGHSA-8QX3-8GM5-9CJ2Highpickem: pickem vulnerable to terminal escape-sequence injection via unsanitized item textCVE-2026-76845Mediumadm-zip: adm-zip extraction follows destination symlinks, allowing arbitrary file overwriteCVE-2026-77415Criticaljsonata: JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressionsCVE-2026-77414Criticaljsonata: JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressionsCVE-2026-77413Criticaljsonata: JSONata: Arbitrary Code Execution via crafted JSONata expressionsCVE-2026-63421High@keystone-6/core: Keystone vulnerable to `graphql.maxTake` bypass with negative `take`CVE-2026-61824Highdefuddle: Defuddle vulnerable to XSS via unescaped attribute interpolation in site extractorsCVE-2026-63466Mediumunleash-server: Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted usernameCVE-2026-63004Mediumunleash-server: Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata…CVE-2026-63462Highunleash-server: Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatterCVE-2026-55451Mediumgettext-converter: gettext-converter: Prototype pollution in js2i18next() via crafted translation keysGHSA-GHVF-QF6H-G8X5High@nocobase/server: NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code executionCVE-2026-55445Critical@whyour/qinglong: Qinglong has an incomplete fix for CVE-2026-3965: Improper AuthenticationCVE-2026-54156Highnode-opcua: node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoSCVE-2026-54155Highnode-opcua: node-opcua missing nonce verification in UserNameIdentityToken authenticationCVE-2026-54150Mediumnext-video: next-video: Unauthenticated arbitrary file read via /api/video request handlerCVE-2026-55410Medium@nocobase/plugin-backups: NocoBase backup restore schema name allows command injectionCVE-2026-63123Medium@tinacms/cli: Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media rootCVE-2026-59992Mediumnext-tinacms-s3: Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)CVE-2026-63188High@logto/tunnel: logto-tunnel serves files outside `--experience-path` via path traversalGHSA-HJWH-XVFW-QRWJMediummcp-searxng: SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo