npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-44789Criticaln8n: n8n: HTTP Request Node Pagination Prototype Pollution to RCECVE-2026-42853Medium@apostrophecms/cli: @apostrophecms/cli: Command Injection in apos create via Unsanitized Password InputCVE-2026-46443Highflowise: FlowiseAI Vulnerable to Credential Data LeakCVE-2026-46442Criticalflowise: FlowiseAI: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox EscapeCVE-2026-46441Highflowise: FlowiseAI has Mass Assignment in Assistant Update Endpoint that Allows Cross-Workspace Resource ReassignmentGHSA-M99R-2HXC-CP3QHighflowise: Flowise has an MCP Security Bypass that Enables RCECVE-2026-46440Highflowise: FlowiseAI Exposes Basic Auth Credentials via APICVE-2026-42863Highflowise: FlowiseAI has Mass Assignment in Chatflow Update Endpoint that Allows Cross-Workspace AgentFlow ReassignmentCVE-2026-42862Highflowise: FlowiseAI has Mass Assignment in Tool Update Endpoint that Allows Cross-Workspace Resource ReassignmentCVE-2026-42861Highflowise: FlowiseAI has Mass Assignment in Variable Update Endpoint that Allows Cross-Workspace Resource ReassignmentCVE-2026-27886Critical@strapi/strapi: Strapi may leak sensitive data via relational filtering due to lack of query sanitizationCVE-2026-22707Medium@strapi/upload: Strapi Upload Plugin MIME Validation Bypass via Content APICVE-2026-22706Low@strapi/admin: Strapi: Password Reset Does Not Revoke Existing Refresh SessionsCVE-2026-22599Critical@strapi/content-type-builder: Strapi Vulnerable to SQL Injection in Content Type BuilderCVE-2025-64526Medium@strapi/plugin-users-permissions: Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keyingCVE-2026-45136Highclaude-code-cache-fix: claude-code-cache-fix vulnerable to local code execution via Python triple-quote injection in tools/quota-statusline.shCVE-2026-45134Highlangsmith: LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warningCVE-2026-44724Highsysteminformation: Systeminformation vulnerable to Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile nameCVE-2026-44720Mediumopenlearnx: OpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account TakeoverCVE-2026-45028Lowastro: Astro: Server island encrypted parameters vulnerable to cross-component replayCVE-2026-44652Mediumsillytavern: SillyTavern has a SSRF vulnerability in the CORS proxy middlewareCVE-2026-44651Mediumsillytavern: SillyTavern has a reflected XSS vulnerability in the CORS proxy middlewareCVE-2026-44650Criticalsillytavern: SillyTavern has a Path Traversal issueCVE-2026-44649Criticalsillytavern: SillyTavern has Authentication Bypass via SSO Header InjectionCVE-2026-44648Highsillytavern: SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo