npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-115477Highobsidian-tc: obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTPCVE-2026-77366Criticalobsidian-tc: obsidian-tc tokens can access arbitrary configured vaultsCVE-2026-77364Mediumobsidian-tc: obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by defaultCVE-2026-77361Mediumobsidian-tc: obsidian-tc : Symlink read-ACL scope bypass via lexical path checksCVE-2026-106765High@rog0x/mcp-docker-tools: @rog0x/mcp-docker-tools: executes arbitrary code via the handleImageList functionCVE-2026-106763High@justice8096/sagemath-mcp-server: @justice8096/sagemath-mcp-server: executes arbitrary code via the escapeShellString and sanitizeCode functionsCVE-2026-106764High@rog0x/mcp-git-tools: @rog0x/mcp-git-tools executes arbitrary code via the resolveBaseBranch functionCVE-2026-114132Mediumnuxt: Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitiveCVE-2026-114133Mediumnuxt: Nuxt server islands render `useHeadSafe` input without sanitisationCVE-2026-114130Lownuxt: Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when…CVE-2026-114131Mediumnuxt: Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and…CVE-2026-113796Mediumelectron: Electron: SameSite cookie restrictions are not applied to windows opened from linksCVE-2026-113798Mediumelectron: Electron: Pointer lock permission requests can be attributed to the wrong frameCVE-2026-113797Lowelectron: Electron: Extension tabs.query returns tab URLs and titles without the tabs permissionCVE-2026-114122Lowelectron: Electron: Frame subscription trusts GPU-supplied frame geometryCVE-2026-114124Lowelectron: Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometryCVE-2026-114121Mediumelectron: Electron: openExternal permission requests can be attributed to the wrong originGHSA-673Q-MJM6-R5XRCriticalnext: Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arraysCVE-2026-107832Lowfastify: fastify is vulnerable to header validation bypass via case-sensitive propertyNamesCVE-2026-114142Hightome: toml-node: Prototype pollution: parsing a TOML document can write to Object.prototypeCVE-2026-114141Hightoml: toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()CVE-2026-114143Hightoml: toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()CVE-2026-114144Hightoml: toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()CVE-2026-114126Highstorybook: Storybook dev server vulnerable to code injection from the local networkCVE-2026-114128Mediumastro: Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo