npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-6733Lowundici: undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse CVE-2026-54051Criticalnetwork-ai: Network-AI: Improper Neutralization of Special Elements used in an OS Command CVE-2026-48814Criticalnetwork-ai: Network-AI: CVE-2026-46701 fix incomplete — empty default secret still authorizes all requests CVE-2026-12644Mediumts-deepmerge: ts-deepmerge: Prototype Method Override leads to DoS CVE-2026-55591Mediumsignalk-server: Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints CVE-2026-0755Criticalgemini-mcp-tool: gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting (CVE-2026-0755)CVE-2026-53854Mediumopenclaw: OpenClaw: Internal/webchat command auth could inherit ownerAllowFrom wildcard state CVE-2026-53852Lowopenclaw: OpenClaw: Empty-scope device re-pairing could confuse caller scope containment CVE-2026-53865Highopenclaw: OpenClaw: Workspace-derived service PATH could influence trash command selection CVE-2026-53858Highopenclaw: OpenClaw: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots CVE-2026-53849Highopenclaw: OpenClaw: Discord allowFrom could bind to mutable display names CVE-2026-53850Mediumopenclaw: OpenClaw: Focus command could miss controlScope enforcement CVE-2026-53846Highopenclaw: OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install CVE-2026-53853Highopenclaw: OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns CVE-2026-53860Lowopenclaw: OpenClaw: BlueBubbles sender policy could match mutable conversation identifiers CVE-2026-53844Mediumopenclaw: OpenClaw: memory-wiki shared search could miss session visibility checks CVE-2026-53856Mediumopenclaw: OpenClaw: Config recovery could restore openclaw.json with broad file permissions CVE-2026-53857Highopenclaw: OpenClaw: Zalo allowFrom could bind to mutable display names CVE-2026-53845Lowopenclaw: OpenClaw: Skill-command dispatch could skip before-tool-call hooks CVE-2026-53847Mediumopenclaw: OpenClaw: Active Memory write scope could mutate global config CVE-2026-53841Mediumopenclaw: OpenClaw: Exported session HTML could keep unsafe markdown links CVE-2026-53851Mediumopenclaw: OpenClaw: Slack reaction events could ignore reaction notification settings CVE-2026-53862Lowopenclaw: OpenClaw: Bootstrap token replay could widen pending pairing scopes CVE-2026-53855Highopenclaw: OpenClaw: Shell positional parameters could weaken strict inline-eval checks CVE-2026-53859Mediumopenclaw: OpenClaw: Hostname checks could treat trailing-dot hosts inconsistently

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo