npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-42282Mediumn8n-mcp: n8n-MCP: Sensitive MCP tool-call arguments logged on authenticated requests in HTTP modeCVE-2026-6951Highsimple-git: simple-git is vulnerable to Remote Code ExecutionCVE-2026-41501Criticalelecterm: electerm has Command Injection via runLinux funtionGHSA-39H7-PWV7-RC3XMedium@excalidraw/excalidraw: Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering)CVE-2026-12537Critical@google/gemini-cli: Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypassesCVE-2026-40068High@anthropic-ai/claude-code: Claude Code: Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code ExecutionCVE-2026-42239High@budibase/backend-core: Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeoverCVE-2026-42190Mediumrwsdk: RedwoodSDK has Same-site CSRF through lack of origin validation in its server actionsCVE-2026-41311Highliquidjs: liquidjs has a Denial of Service via circular block reference in layoutCVE-2026-41305Mediumpostcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify OutputCVE-2026-41321Low@astrojs/cloudflare: Cloudflare has SSRF via redirect following through its image-binding-transform endpoint (incomplete fix for GHSA-qpr4)CVE-2026-41900Highopenlearnx: OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution EnvironmentCVE-2026-33318High@actual-app/sync-server: Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated ServersCVE-2026-41322Medium@astrojs/node: Astro: Cache Poisoning due to incorrect error handling when if-match header is malformed CVE-2026-41495Mediumn8n-mcp: n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp RequestsCVE-2026-6874Lowcopilot-api: copilot-api has Reliance on Reverse DNS Resolution for a Security-Critical ActionCVE-2026-42075High@evomap/evolver: Evolver: Path Traversal via `--out` flag in `fetch` command allows Arbitrary File WriteCVE-2026-42076Critical@evomap/evolver: Evolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code ExecutionCVE-2026-42077Medium@evomap/evolver: Evolver has Prototype Pollution via `Object.assign()` in its mailbox store operationsCVE-2026-41907Mediumuuid: uuid: Missing buffer bounds check in v3/v5/v6 when buf is providedGHSA-P3H2-2J4P-P83GHigh@samanhappy/mcphub: MCPHub has Path Traversal via Malicious MCPB Manifest NameCVE-2026-41886Highlocize: locize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext Editor CVE-2026-41885Mediumi18next-locize-backend: i18next-locize-backend has URL Injection via Unsanitized Path ParametersCVE-2026-41683Highi18next-http-middleware: i18next-http-middleware: HTTP response splitting and DoS via unsanitised Content-Language headerCVE-2026-41673High@xmldom/xmldom: xmldom: Uncontrolled recursion in XML serialization leads to DoS

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo