npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-47760Hightinymce: TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs CVE-2026-53926Mediumnocodb: NocoDB: OAuth Tokens Persist Through Security Events CVE-2026-48017Highdbgate-api: DbGate: Remote Code Execution via functionName injection in loadReader endpoint CVE-2026-47684High@sync-in/server: Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP CVE-2026-47670Criticaldbgate-api: Authenticated Remote Code Execution via loadReader functionName code injection in DbGate CVE-2026-47669Criticaldbgate: DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE CVE-2026-47668Criticaldbgate-serve: DbGate: Unauthenticated Remote Code Execution via JSON Script Runner CVE-2026-47388Lownocodb: NocoDB: Missing Ownership Check in MCP Attachment Read CVE-2026-47387Highnocodb: NocoDB: Stored Cross-Site Scripting via Form View Redirect URL CVE-2026-47386Mediumnocodb: NocoDB: OAuth Authorization Code Race Condition CVE-2026-47385Mediumnocodb: NocoDB: Path Traversal via SQLite Source Filename CVE-2026-47384Mediumnocodb: NocoDB: SQL Injection via Column Title in Bulk GroupBy CVE-2026-47383Highnocodb: NocoDB: Stored Cross-Site Scripting via Row Comments CVE-2026-47382Mediumnocodb: NocoDB: Server-Side Request Forgery via Database Connection Host CVE-2026-47381Mediumnocodb: NocoDB: Cross-Workspace Integration Use in Connection Test CVE-2026-47380Mediumnocodb: NocoDB: User Enumeration via Sign-In Timing CVE-2026-47379Mediumnocodb: NocoDB: Plaintext Password Comparison in Shared Views CVE-2026-47378Mediumnocodb: NocoDB: Hidden Column Exposure in Public Shared View Endpoints CVE-2026-47377Mediumnocodb: NocoDB: Open Redirect via Hash Fragment in hashRedirect Plugin CVE-2026-47376Mediumnocodb: NocoDB: Reflected Cross-Site Scripting via Password Reset Token CVE-2026-47375Mediumnocodb: NocoDB: Postgres SQL Injection in Formula `ARRAYSORT`CVE-2026-47279Mediumnocodb: NocoDB: Hidden LTAR Column Exposure in Public Shared-View Relation Endpoints CVE-2026-47250Mediummcp-server-kubernetes: MCP Server Kubernetes: kubectl-generic flag injection enables Kubernetes bearer token exfiltration CVE-2026-11330Lowclaude-mem: claude-mem: The computeObservationContentHash Function is Vulnerable to Hash Collision CVE-2026-10732Mediumdecompress: decompress: Arbitrary File Write via Archive Extraction (Zip Slip)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo