npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-41674High@xmldom/xmldom: xmldom has XML injection through unvalidated DocumentType serializationCVE-2026-41675High@xmldom/xmldom: xmldom has XML node injection through unvalidated processing instruction serializationCVE-2026-41672High@xmldom/xmldom: xmldom has XML node injection through unvalidated comment serializationCVE-2026-41640High@nocobase/database: @nocobase/database has SQL Injection via String Concatenation through Recursive Eager LoadingCVE-2026-41641High@nocobase/plugin-collection-sql: @nocobase/plugin-collection-sql: SQL Validation Bypass Through Missing `checkSQL` CallCVE-2026-41650Mediumfast-xml-parser: fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped DelimitersCVE-2026-41591Mediummarko: Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escapingCVE-2026-41693Highi18next-fs-backend: i18next-fs-backend: Path traversal via unsanitised lng/ns allows arbitrary file read/overwriteCVE-2026-41692Mediumi18nextify: i18nextify has DOM XSS via javascript:/data: URL schemes in translated href/src attributesCVE-2026-41691Mediumi18next-http-backend: i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/nsCVE-2026-41690Highi18next-http-middleware: i18next-http-middleware: Prototype pollution and path traversal via user-controlled language and namespace parametersCVE-2026-41240Mediumdompurify: DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)CVE-2026-41239Mediumdompurify: DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM modeCVE-2026-41238Mediumdompurify: DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING FallbackGHSA-2R2P-4CGF-HV7HHighengramx: engram: HTTP server CORS wildcard + auth-off-by-default enables CSRF graph exfiltration and persistent indirect prompt injectionGHSA-9237-RG5P-RHFWHigh@saltcorn/data: @saltcorn/data: Tenant user role is used for tenant creation role checkCVE-2026-41067Mediumastro: Astro: XSS in define:vars via incomplete </script> tag sanitizationCVE-2026-41264Criticalflowise: Flowise: CSV Agent Prompt Injection Remote Code Execution VulnerabilityCVE-2026-39861High@anthropic-ai/claude-code: Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside WorkspaceCVE-2026-39320Highsignalk-server: Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription PathsCVE-2026-40155Medium@auth0/nextjs-auth0: Auth0 Next.js SDK has Improper Proxy Cache LookupCVE-2026-35570High@gitlawb/openclaude: OpenClaude: Sandbox Bypass via Early-Exit Logic Flaw Allows Path Traversal CVE-2026-6594Medium@brikcss/merge: Deep Merge is Vulnerable to Prototype Pollution Through Lack of SanitizationCVE-2026-41265Criticalflowise: Flowise: Airtable_Agent Code Injection Remote Code Execution VulnerabilityGHSA-F934-5RQF-XX47Mediumopenclaw: OpenClaw: QMD memory_get restricts reads to canonical or indexed memory paths

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo