npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-45149Mediumbrace-expansion: brace-expansion: Large numeric range defeats documented `max` DoS protection CVE-2026-45577Mediumneotoma: Neotoma: Unauthenticated Inspector/API access via reverse-proxy loopback auth bypass GHSA-97R8-RF7Q-WMJWLow@sveltia/cms: Sveltia CMS: Stored XSS in entry summary rendering via entity-decoded HTML CVE-2026-6402Mediumwebpack-dev-server: webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins CVE-2026-46510Highform-data-objectizer: form-data-objectizer: Prototype pollution in form-data-objectizer via bracket-notation form keys CVE-2026-45582Mediumn8n-mcp: n8n-MCP: Workflow telemetry sanitizer could retain partial values from URL-shaped node parameters CVE-2026-8769Low@ai-sdk/provider-utils: @ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue CVE-2026-8766Low@kilocode/cli: @kilocode/cli Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor CVE-2026-8657Highjsondiffpatch: jsondiffpatch patch APIs are vulnerable to prototype pollution CVE-2026-45717High@budibase/server: Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any…CVE-2026-45715High@budibase/server: Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration CVE-2026-45548High@budibase/server: Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation CVE-2026-45364Highbetter-auth: Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation GHSA-WXW3-Q3M9-C3JRMediumbetter-auth: Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage is used without PKCE CVE-2026-22810High@joplin/onenote-converter: @joplin/onenote-converter: Path traversal in OneNote importer allows overwriting arbitrary files CVE-2026-38728Highsmtp-server: smtp-server's command parser memory exhaustion denial-of-service CVE-2026-45411Criticalvm2: vm2 Has a Sandbox Breakout Using Async Generator CVE-2026-46509High@ranfdev/deepobj: @ranfdev/deepobj has a Prototype Pollution vulnerability CVE-2026-45366Medium@utcp/http: @utcp/http: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol GHSA-WF8Q-WVV8-P8JFCritical@samanhappy/mcphub: @samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without Authentication, Enabling User Impersonation GHSA-F3CJ-J4F6-WQ85Mediumsvelte: Svelte: SSR XSS via Insecure Promise Serialization in hydratable CVE-2026-45787Mediumelecterm: electerm's encrypt method not safe enough CVE-2026-45353Criticalelecterm: Electerm Local code through electerm's single-instance socket CVE-2026-45311Criticaldeepseek-tui: DeepSeek TUI: run_tests Tool Enables RCE via Malicious Repository Without Approval CVE-2026-45310Highdeepseek-tui: DeepSeek TUI has SSRF via HTTP Redirect Bypass in fetch_url Tool

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.