npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-47138Highparse-server: Parse Server: Pre-authentication denial of service via client version header regex backtracking CVE-2026-8723Mediumqs: qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when…CVE-2026-46701Highnetwork-ai: Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret CVE-2026-46703Criticalboxlite: Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host CVE-2026-46695Criticalboxlite: BoxLite: Permission Bypass Allows Modification of Read-Only Files CVE-2026-46681High@nevware21/ts-utils: @nevware21/ts-utils: Prototype Pollution in objDeepCopy/objCopyProps via for...in without hasOwnProperty CVE-2026-46679High@libp2p/gossipsub: js-libp2p: Memory DoS via subscription flood of unique topics CVE-2026-46625Highjs-cookie: JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection GHSA-59F3-7227-WMH4High@hulumi/policies: @hulumi/policies: Stack-wide evidence bypassed Cloudflare and deployment-governance guardrails GHSA-Q2F7-M237-V562Critical@hulumi/policies: @hulumi/policies: GitHub OIDC trust policy bypass via AWS set-qualified condition operators GHSA-4XRH-5M3M-328WHigh@hulumi/policies: @hulumi/policies: CIS 1.16 admin policy bypass for inline and attached IAM policies GHSA-G43V-9X7Q-83PQHigh@hulumi/policies: @hulumi/policies: HULUMI-H1 SecureBucket parent spoof bypass GHSA-2FFM-HXRQ-QQMMHigh@hulumi/drift: @hulumi/drift: Orphan reconciler accepted externally supplied execute plans GHSA-GFP8-MP24-5VXGMedium@hulumi/baseline: @hulumi/baseline: CloudTrail selector tampering events were not fully detected CVE-2026-46554Lownocodb: NocoDB: Stale Auth Cache After API Token Deletion CVE-2026-46553Lownocodb: NocoDB: Attachment Size Limit Bypass via Upload-by-URL CVE-2026-46552Mediumnocodb: NocoDB: Shared-base link access can invite arbitrary users as persistent base members CVE-2026-46551Mediumnocodb: NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion CVE-2026-46550Mediumnocodb: NocoDB: Refresh Token Cookie Set Without `secure` and `sameSite` Flags CVE-2026-46549Lownocodb: NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation CVE-2026-46548Mediumnocodb: NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams)CVE-2026-46547Mediumnocodb: NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL CVE-2026-46519Highmcp-server-kubernetes: MCP Server Kubernetes: Tool Access Control Bypass via Presentation-Layer Filtering Without Execution-Layer Enforcement GHSA-HGV7-V322-MMGRMedium@sveltejs/kit: @sveltejs/kit: `query.batch` cross-talk CVE-2026-46492Highmd-fileserver: md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.