npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-70600Lowelectron: Electron: Cross-origin iframe can position native autofill popup CVE-2026-70599Mediumelectron: Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin CVE-2026-70598Lowelectron: Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size CVE-2026-70597Mediumelectron: Electron: Parent process code-sign check is spoofable CVE-2026-53949Mediumghost: Ghost Content API filter bypass reveals private fields CVE-2026-70596Mediumghost: Ghost: Cross-Site Scripting in Feature Image Captions CVE-2026-70595Mediumghost: Ghost: Server-Side Request Forgery Mitigation Issue CVE-2026-59817Mediumghost: Ghost: Paid gift memberships obtainable at minimal cost via the donations feature CVE-2026-53947Mediumghost: Ghost: Member existence leak via magic link sign-in response CVE-2026-53950High@tryghost/activitypub: XSS in Ghost's ActivityPub client CVE-2026-70594Mediumghost: Ghost: Session Fixation in Ghost Admin CVE-2026-70593Mediumghost: Ghost: Theme Upload Path Traversal CVE-2026-70592Mediumghost: Ghost: Database Backup Path Traversal CVE-2026-70591Mediumghost: Ghost: Server-Side Request Forgery in Image Fetching CVE-2026-70590Mediumghost: Ghost: Blind Password Hash Disclosure in Ghost Admin API CVE-2026-53946Mediumghost: Ghost: Mobiledoc image-size fetch SSRF CVE-2026-53945Mediumghost: Ghost: Server-side request forgery via DNS rebinding in external request handling CVE-2026-53944Mediumghost: Ghost: Private IP filtering bypass to make server-side requests to internal services CVE-2026-70589Mediumghost: Ghost: Archived Offers can be Redeemed CVE-2026-53948Mediumghost: Ghost: File Upload Content-Type Spoofing CVE-2026-70588Mediumghost: Ghost: Cross-Site Scripting in Universal Import CVE-2026-70478Criticalflowise: Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service CVE-2026-70477Criticalflowise: Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability CVE-2026-70476Highflowise: Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation GHSA-8GJ2-2CVC-6XX7Mediumflowise: Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo