npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-HV85-774V-26FGHighauth-fetch-mcp: auth-fetch-mcp: SSRF and disk exfiltration via unvalidated auth_fetch and download_media URLsCVE-2026-46511High@haxtheweb/haxcms-nodejs: HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack CVE-2026-46396High@haxtheweb/haxcms-nodejs: Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeoverCVE-2026-46395Critical@haxtheweb/haxcms-nodejs: HAXcms: Private Key Disclosure via Broken HMAC ImplementationCVE-2026-46391High@haxtheweb/open-apis: HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apisCVE-2026-46496Medium@haxtheweb/haxcms-nodejs: HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theftCVE-2026-46393High@haxtheweb/haxcms-nodejs: HAXcms createSite SSRF Enables Arbitrary File ReadGHSA-27F5-XJRR-Q9FFCritical@opensearch-project/opensearch: Malware in @opensearch-project/opensearchCVE-2026-45244Low@steipete/summarize: Summarize contains a missing authorization vulnerabilityCVE-2026-45245Medium@steipete/summarize: Summarize's hover summary feature allows malicious pages to dispatch synthetic mouseover events over attacker-controlled linksCVE-2026-45243Medium@steipete/summarize: Summarize contains a missing authorization vulnerabilityCVE-2026-45242High@steipete/summarize: Summarize contains a path traversal vulnerabilityCVE-2026-45736Mediumws: ws: Uninitialized memory disclosureCVE-2025-57282Highngrok: ngrok is Vulnerable to Command InjectionGHSA-JGG6-4RPR-WFH7Low@mistralai/mistralai: Broken dropper in @mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/mistralai-gcpCVE-2026-45719Medium@budibase/server: Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API CVE-2026-45718Mediumbudibase: Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope RowsCVE-2026-45716High@budibase/worker: Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP ConfigurationCVE-2026-45707Highn8n-mcp: n8n-MCP: Multi-tenant MCP requests fall back to process-level n8n credentials when tenant headers are absent or incompleteCVE-2026-8159Highmultiparty: multiparty vulnerable to ReDoS via filename parsingCVE-2026-8162Highmultiparty: multiparty vulnerable to Denial of Service via Uncaught Exception in filename* parameter parsingCVE-2026-8161Highmultiparty: multiparty: Denial of Service via Prototype Pollution leads to Uncaught ExceptionCVE-2026-45325High@tmlmobilidade/utils: @tmlmobilidade/utils has prototype pollution in its setValueAtPathGHSA-FVH2-GM75-J4J7Highdynoxide-rs: dynoxide: DNS rebinding and cross-origin CSRF via MCP HTTP transportCVE-2026-45302Highparse-nested-form-data: parse-nested-form-data has Prototype Pollution via `__proto__` in FormData field names

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo