npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-48069High@grpc/grpc-js: @grpc/grpc-js: An incoming malformed compressed message can cause a client or server crashCVE-2026-48038Mediumjoi: joi has an uncaught RangeError on deeply nested input through recursive `link()` schemasCVE-2026-48054High@openzeppelin/wizard: OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uriCVE-2026-48022Medium@hapi/wreck: @hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirectsCVE-2026-48007High@element-hq/element-call-embedded: Element Call reports full URLs of visited pages to analytics serverCVE-2026-48063Criticalbaileys: Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payloadCVE-2025-71330Highimage-size: image-size: ICNS parser allows denial of service through an infinite loopCVE-2025-71329Highimage-size: image-size: JXL and HEIF parsers allow denial of service through infinite loopsCVE-2026-48051Low@papra/webhooks: Papra HTTP redirect bypass can lead to SSRF via webhook delivery systemCVE-2026-48037Medium@hulumi/baseline: @hulumi/baseline: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub postureCVE-2026-48036High@hulumi/drift: @hulumi/drift: Drift classifier fails open on adapter errors and over-promotes Mixed verdictsCVE-2026-48035High@hulumi/baseline: @hulumi/baseline: AccountFoundation audit-delivery S3 bucket could be silently weakenedCVE-2026-48034High@hulumi/policies: @hulumi/policies has a HULUMI-H5 bypass via decoy sibling resources targeting a different bucketCVE-2026-48033High@hulumi/policies: @hulumi/policies bypasses policy packs with a forged Pulumi-URN logical nameCVE-2026-48032High@hulumi/policies: @hulumi/policies bypasses IAM-role policy checks when the role trusts multiple OIDC providersCVE-2026-9277Criticalshell-quote: shell-quote quote() does not escape newlines in object .op valuesCVE-2026-11572Highdegit: degit has a Command Injection issueCVE-2026-47721Mediumfuxa-server: FUXA's scheduler API missing admin check enables operator-to-admin escalation via scheduled device actionsCVE-2026-47720Mediumfuxa-server: FUXA has SQL Injection in its TDengine DAQ connector via backslash bypass of escapeTdStringCVE-2026-47719Highfuxa-server: FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response readingCVE-2026-42890Mediumactual: actual Allows Electron to Run As NodeCVE-2026-47430Criticalcordova-plugin-inappbrowser: Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews.CVE-2026-47761Hightinymce: TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injectionCVE-2026-47762Hightinymce: TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` commentsCVE-2026-47759Hightinymce: TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo