npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-11998Highangular: Angular's deprecated package has a Cross-Site Scripting issueCVE-2026-54350Critical@budibase/server: Budibase has nonymous NoSQL operator injection via published-app query templatesCVE-2026-12866Criticalexpr-eval: expr-eval vulnerable to Code ExecutionCVE-2026-50179Medium@actual-app/web: @actual-app/web has CSV Formula Injection in Transaction Export via Imported Payee/Notes FieldsCVE-2026-54353High@budibase/backend-core: @budibase/backend-core has potential SSRF DNS rebinding bypass in outbound fetch validationCVE-2026-54352Critical@budibase/server: Budibase has arbitrary file read by workspace-builder via PWA-zip symlink uploadCVE-2026-54351High@budibase/server: Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId OverrideCVE-2026-49229High@actual-app/sync-server: @actual-app/sync-server: Disabled OpenID users keep access through existing session tokensCVE-2026-50137High@budibase/server: Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored…CVE-2026-50136High@budibase/server: Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentialsCVE-2026-50132High@budibase/server: Budibase has an Account Impersonation Issue — Chat Identity Link Hijacking via Missing Consent & CSRFGHSA-HVQH-JW65-WCPQMediumdevbridge-autocomplete: devbridge-autocomplete has XSS in its default formatters: formatGroup and formatResult fail to escape HTML in untrusted inputsCVE-2026-48170Criticalscim-patch: scimPatch vulnerable to prototype pollution via unfiltered keys in patchCVE-2026-48153High@budibase/server: Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadataCVE-2026-46700Medium@actual-app/sync-server: @actual-app/sync-server's missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync…CVE-2026-46672Medium@actual-app/cli: @actual-app/cli `--format csv` Output Vulnerable to CSV Formula Injection via Custom `escapeCsv` HelperGHSA-G2GW-Q38M-VJFCHigh@merill/lokka: Lokka: Azure Resource Manager URL path validation issueGHSA-H5X8-XP6M-X6Q4High@jhb.software/payload-cloudinary-plugin: @jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter SigningGHSA-X975-RGX4-5FH4Highappium-mcp: appium-mcp: Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGeneratorUI)GHSA-V3F4-W7R7-V3HMHigh@zenalexa/unicli: Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requestsGHSA-97PR-9HGG-3P8RLowparse-server: parse-server: LiveQuery discloses object data to a subscriber across an ACL read-access changeGHSA-MRVX-JMJW-VGGCHighmcp-searxng: SearXNG MCP Server: DNS-resolved Private Hostname SSRF in `web_url_read`GHSA-XCQX-9JF5-W339Highmcp-searxng: SearXNG MCP Server: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`GHSA-48X2-6PR9-2JJFMediumnetwork-ai: Network-AI: EnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment dataGHSA-6X2M-P4XP-WG22Mediumnetwork-ai: Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo