npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-113650Mediumsanitize-html: ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not…CVE-2026-113649Medium@apostrophecms/import-export: ApostropheCMS: Import API bypasses publication roles for protected content CVE-2026-112956Medium@apostrophecms/import-export: ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content CVE-2026-112955Medium@apostrophecms/import-export: ApostropheCMS: Import archives can exhaust server storage and deny service CVE-2026-112945Lowvite: Vite: Cross origin script execution through Vite custom middleware CVE-2026-112946Mediumvite: Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine CVE-2026-112947Mediumvite: Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`CVE-2026-113711Highapostrophe: ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export CVE-2026-111753Medium@angular/common: @angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)CVE-2026-111758Highmarkdown-it: markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)CVE-2026-111766Lowmarkdown-it: markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled CVE-2026-111770High@modelcontextprotocol/server: MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another CVE-2026-111768High@modelcontextprotocol/sdk: MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation CVE-2026-112944Mediumlaunch-editor: launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors CVE-2026-112942Highlaunch-editor: launch-editor: `fs.existsSync()` existence check can be bypassed on Windows CVE-2026-111771Medium@modelcontextprotocol/sdk: MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service CVE-2026-112943Mediumlaunch-editor: launch-editor: escapeCmdArgs() omits % escaping on Windows CVE-2026-111767High@modelcontextprotocol/sdk: MCP TypeScript SDK: Experimental tasks were not tied to the session that created them CVE-2026-111769Medium@modelcontextprotocol/sdk: MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request…CVE-2026-113653Mediumapostrophe: ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)CVE-2026-113665Lowapostrophe: ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints CVE-2026-113664Medium@apostrophecms/import-export: ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test CVE-2026-113651Lowuploadfs: ApostropheCMS: Path traversal in uploadfs CVE-2026-113657Lowsanitize-html: ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)CVE-2026-113652Mediumuploadfs: ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.