npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-42573Mediumsvelte: Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework StateCVE-2026-42567Mediumsvelte: Svelte: ReDoS in `<svelte:element>` Tag ValidationCVE-2026-45665Highopen-webui: Open WebUI has Stored XSS in Banner Component via Improper Sanitization OrderCVE-2026-45395Highopen-webui: Open WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code ExecutionCVE-2026-42570Highdevalue: Svelte devalue: DoS via sparse array deserializationCVE-2026-45346Mediumopen-webui: Open WebUI Has Stored Cross-Site Scripting in SVG RendererCVE-2026-42599Mediumsvelte: Svelte SSR vulnerable to cross-site scripting via spread attributesCVE-2026-45058Criticalelecterm: Electerm: Importing unsafe bookmark data could lead to unsafe operation when clicking local type bookmarkCVE-2026-45011Highapostrophe: Apostrophe has stored XSS via javascript: URL in Image Widget LinkCVE-2026-45013Highapostrophe: Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input ValidationCVE-2026-45012Highapostrophe: Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widgetCVE-2026-44990Criticalsanitize-html: Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`GHSA-7RX4-C5VX-G8W3High@karakeep/sdk: Karakeep SDK has SSRF via metascraper-logo-favicon that bypasses validateUrl protectionsGHSA-9M65-766C-R333Medium@tanstack/start-server-core: TanStack Start - Server Core: Inbound server-function request deserialization could invoke a sibling client-referenced server functionCVE-2026-46480Highflowise: FlowiseAI: Evaluator create+update mass-assignment allows cross-workspace evaluator takeoverCVE-2026-46479Highflowise: FlowiseAI: Evaluation create+update mass-assignment allows cross-workspace evaluation takeoverCVE-2026-46478Highflowise: FlowiseAI: DatasetRow create+update mass-assignment allows cross-workspace row takeoverCVE-2026-46477Highflowise: FlowiseAI: Dataset create+update mass-assignment allows cross-workspace dataset takeoverCVE-2026-46476Highflowise: FlowiseAI: CustomTemplate create+update mass-assignment allows cross-workspace template takeoverCVE-2026-46475Highflowise: FlowiseAI: Assistant create+update mass-assignment allows cross-workspace assistant takeoverCVE-2026-46444Highflowise: FlowiseAI: Vector Store No Permission ChecksCVE-2026-45732Highn8n: n8n Has a Cross-user Authorization Bypass in Dynamic Credential OAuth EndpointsCVE-2026-44792Highn8n: n8n Has a Source Control Pull SQL InjectionCVE-2026-44791Criticaln8n: n8n Has an XML Node Prototype Pollution Patch BypassCVE-2026-44790Criticaln8n: n8n Has an Arbitrary File Read via Git Node

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo