npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-55661Mediumtinacms: TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemesCVE-2026-55617Mediumhydrooj: Hydro: Insufficient session expiration when recreating sessionsCVE-2026-55603Highhttp-proxy-middleware: http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`CVE-2026-55602Mediumhttp-proxy-middleware: http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypassCVE-2026-55388Highpiscina: piscina: Prototype Pollution Gadget → RCE via inherited options.filenameCVE-2026-55886Mediumjodit: jodit: Prototype pollution in Jodit via Jodit.modules.Helpers.set()CVE-2026-53863Mediumopenclaw: OpenClaw: Tool group policy callers could accept unvalidated group IDsCVE-2026-53842Highopenclaw: OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud executionCVE-2026-53866Highopenclaw: OpenClaw: Shell inline-command parsing could miss an allowlist checkCVE-2026-53843Highopenclaw: OpenClaw: Pairing-scoped device session could restore revoked node token authorityCVE-2026-53864Highopenclaw: OpenClaw: Host environment sanitizer missed two Node.js control variablesCVE-2026-9595Mediumwebpack-dev-server: webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxiesCVE-2026-5079Highmulter: Multer vulnerable to Denial of Service via deeply nested field namesCVE-2026-5038Mediummulter: Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploadsCVE-2026-54316Medium@anthropic-ai/claude-code: Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetchCVE-2026-53840Highopenclaw: OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another originCVE-2026-53931Mediumnocodb: NocoDB: Server-Side Request Forgery via Spreadsheet Import EndpointCVE-2026-53930Mediumnocodb: NocoDB: Server-Side Request Forgery via Base Migration URLCVE-2026-53929Mediumnocodb: NocoDB: Stored Cross-Site Scripting via Secure AttachmentCVE-2026-53928Mediumnocodb: NocoDB: Refresh Tokens Persist Through Password RecoveryCVE-2026-53927Mediumnocodb: NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URLCVE-2026-53765Mediumchrome-devtools-mcp: Chrome DevTools for agents: daemon.pid write follows symlinks in /tmp fallback runtime directoryGHSA-664H-GPGQ-H6XXMediumn8n: n8n: Wrong OAuth Scope on Evaluation Test Runs EndpointsCVE-2026-54325Medium@earendil-works/pi-coding-agent: Pi Agent: Pi loads project-local extensions without approvalCVE-2026-54328High@earendil-works/pi-coding-agent: Pi Agent: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo