npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-54545High@wakaru/cli: @wakaru/cli arbitrary file write during bundle unpack GHSA-8Q49-2H5H-434XMedium@frontmcp/adapters: FrontMCP: Server-Side Request Forgery (SSRF) in the OpenAPI adapter spec-change poller CVE-2026-73647Mediumquasar: Quasar: Prototype pollution in the extend() utility CVE-2026-73413Highshescape: Shescape: Quadratic-time denial of service in the flag-protection CVE-2026-73411Mediumshescape: Shescape: Home-directory disclosure in assignment context on Unix with Dash CVE-2026-73414Criticalshescape: Shescape: Shell injection via unescaped parentheses on Windows with CMD CVE-2026-73412Mediumshescape: Shescape: Path disclosure on Unix with Zsh CVE-2026-14257Highbrace-expansion: brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash CVE-2026-73567Criticalsm-crypto: sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock CVE-2026-73561High@anephenix/hub: @anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion CVE-2026-73307Medium@budibase/server: Budibase: SSRF via bare fetch() in uploadUrl during AI table generation CVE-2026-73410High@budibase/server: Budibase: SSRF via DNS rebinding in the REST datasource integration GHSA-PMPG-2MXQ-6XWRHigh@budibase/server: Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete CVE-2026-73306Medium@budibase/server: Budibase: Account Enumeration via Login Lockout Response Differential GHSA-PVCR-8MVP-W8QRHigh@budibase/server: Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF)GHSA-2XGG-R2WC-C5R2High@budibase/server: Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector GHSA-QW6M-8FW2-2V64High@budibase/server: Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution CVE-2026-73308Medium@budibase/server: Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders CVE-2026-73406High@budibase/server: Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint GHSA-MQHR-6J6H-74P5Critical@budibase/server: Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak CVE-2026-73302Critical@budibase/server: Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified GHSA-XG5G-26X8-CVF4High@budibase/server: Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution GHSA-XCX6-4F2G-HHGXHigh@budibase/server: Budibase: S3 presigned URL endpoint authorization regression in v3.39.4 allows BASIC users to obtain S3 PutObject presigned URLs CVE-2026-73409High@budibase/server: Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile CVE-2026-73300Critical@budibase/server: Budibase: SQL Injection via `multipleStatements: true`

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo