npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-44214Mediumeventsource-encoder: eventsource-encoder vulnerable to SSE event injection via unsanitized `event` and `id` fieldsCVE-2026-44211Criticalcline: Cline Kanban Server has a Cross-Origin WebSocket Hijacking VulnerabilityCVE-2026-44728High@babel/plugin-transform-modules-systemjs: @babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious inputGHSA-QHH4-458H-XWH2Medium@cyclonedx/cdxgen: @cyclonedx/cdxgen: Docker registry auth substring match forwards credentials to a different registryCVE-2026-44680High@mikro-orm/sql: MikroORM has SQL injection via runtime-controlled identifiers and JSON-path keysCVE-2026-6322Highfast-uri: fast-uri vulnerable to host confusion via percent-encoded authority delimitersCVE-2026-44721Highopen-webui: open-webui Vulnerable to Stored XSS via Model DescriptionCVE-2026-43944Criticalelecterm: Electerm users can run dangrous code through link or command lineCVE-2026-43943Highelecterm: Electerm Security Vulnerability: RCE via malicious SSH server filename in openFileWithEditorCVE-2026-43942Mediumelecterm: Electerm's full process.env exposed to renderer via window.pre.envCVE-2026-43941Highelecterm: Electerm has an unvalidated shell.openExternal that allows arbitrary protocol execution via terminal link clickCVE-2026-43940Criticalelecterm: Electerm runWidget has a path traversal that leads to arbitrary code executionCVE-2026-6321Highfast-uri: fast-uri vulnerable to path traversal via percent-encoded dot segmentsCVE-2026-7768High@fastify/accepts-serializer: @fastify/accepts-serializer Vulnerable to Denial of Service via Unbounded Accept Header Cache GrowthGHSA-8G7G-HMWM-6RV2Highn8n-mcp: n8n-mcp affected by path traversal, redirect-following SSRF, and telemetry payload exposureCVE-2026-44694Highn8n-mcp: n8n-mcp webhook and API client paths has an authenticated SSRFCVE-2026-44665Highfast-xml-builder: fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributesCVE-2026-44664Mediumfast-xml-builder: fast-xml-builder Comment Value regex can be bypassedGHSA-2CM2-M3W5-GP2FMediumvm2: vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`CVE-2026-44009Criticalvm2: vm2 has Sandbox Breakout Through Null Proto ExceptionCVE-2026-44008Criticalvm2: vm2 has sandbox breakout via `neutralizeArraySpeciesBatch`CVE-2026-8115Mediumshort-video-maker: short-video-maker has a path traversal vulnerabilityGHSA-J7H9-2JH7-G967Highmcp-ssh-tool: mcp-ssh-tool has file transfer path policy bypass and bearer token comparison hardeningCVE-2026-44589Lownuxt-og-image: nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect)CVE-2025-63704Criticalquery-string-parser: query-parser-string is vulnerable to Prototype Pollution

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo