npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-54689Mediummcp-searxng: SearXNG MCP Server: Additional hardened-mode SSRF bypasses CVE-2026-54688Mediummcp-searxng: SearXNG MCP Server is Vulnerable to SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off)CVE-2026-53957High@contentful/mcp-server: Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to…GHSA-RR55-JP92-8WP2Highclaude-faf-mcp: claude-faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF tools GHSA-J4R7-8PH4-43G3Highfaf-mcp: faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF tools GHSA-CC2G-GQ8C-R332Highgrok-faf-mcp: grok-faf-mcp has an arbitrary local file read via unconfined `path` argument in FAF tools GHSA-C7HR-448W-65PXHighmeshcentral: MeshCentral has unsanitized data fields CVE-2026-63640Mediummagicmirror: MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables CVE-2026-55178High@geolens/sdk: GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile…CVE-2026-63643Mediummagicmirror: MagicMirror: ssrf calendar .js CVE-2026-63642Mediummagicmirror: MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery CVE-2026-63641Lowmagicmirror: MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions GHSA-2MF3-MR2R-R4VFHigh@rhinostone/swig: @rhinostone/swig: arbitrary local file read via include/extends path traversal CVE-2026-69148Highmlflow: MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id CVE-2026-69146Mediummlflow: MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth CVE-2026-56677High9router: 9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint CVE-2026-53766Mediumchrome-devtools-mcp: chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots CVE-2026-55090Highep_etherpad-lite: Etherpad has stored XSS in HTML export via unescaped attribute-pool values GHSA-92HR-GMR6-H8CPMediumep_etherpad-lite: Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling GHSA-V836-6XW4-9CX3Highvm2: vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass GHSA-M5W8-4GQ2-6F8XCriticalvm2: vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of…CVE-2026-47698Criticalvm2: vm2: Sandbox Breakout Using Dangerous Host Proto Mutators CVE-2026-47686Criticalvm2: VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE CVE-2026-47683Highvm2: vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike CVE-2026-19693Highextract-zip: extract-zip allows arbitrary file writes through symlink archive entries

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.