npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-VR7G-88FQ-VHQ3Critical@paperclipai/server: Paperclip: OS Command Injection via Execution Workspace cleanupCommandGHSA-GQQJ-85QM-8QHFHighpaperclipai: Paperclip: codex_local inherited ChatGPT/OpenAI-connected Gmail and was able to send real emailGHSA-XFQJ-R5QW-8G4JHigh@paperclipai/server: Paperclip: Unauthenticated Access to Multiple API Endpoints in Authenticated ModeGHSA-W8HX-HQJV-VJCQHigh@paperclipai/server: Paperclip: Malicious skills able to exfiltrate and destroy all user dataCVE-2026-41208High@paperclipai/server: Paperclip: Privilege Escalation via Agent-Controlled workspaceStrategy.provisionCommand Leading to OS Command ExecutionGHSA-3PW3-V88X-XJ24Medium@paperclipai/shared: Paperclip: Arbitrary File Read via Agent-Controlled adapterConfig.instructionsFilePathCVE-2026-41427High@better-auth/oauth-provider: OAuth 2.1 Provider: Unprivileged users can register OAuth clientsCVE-2026-41428Critical@budibase/backend-core: Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected EndpointsCVE-2026-40897Highmathjs: Unsafe object property setter in mathjsCVE-2026-41423High@angular/platform-server: Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-ServerCVE-2026-41242Criticalprotobufjs: protobufjs has an arbitrary code execution issueCVE-2026-6410Medium@fastify/static: @fastify/static vulnerable to path traversal in directory listingCVE-2026-6414Medium@fastify/static: @fastify/static vulnerable to route guard bypass via encoded path separatorsCVE-2026-6270Critical@fastify/middie: @fastify/middie vulnerable to middleware authentication bypass in child plugin scopesCVE-2026-33804High@fastify/middie: @fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes optionCVE-2026-41276Highflowise: Flowise: resetPassword Authentication Bypass VulnerabilityCVE-2026-41274Highflowise: Flowise: Cypher Injection in GraphCypherQAChainCVE-2026-41275Highflowise: Flowise: Password Reset Link Sent Over Unsecured HTTPCVE-2026-41273Highflowise: Flowise: Unauthenticated OAuth 2.0 Access Token Disclosure via Public Chatflow in FlowiseCVE-2026-41271Highflowise: Flowise: APIChain Prompt Injection SSRF in GET/POST API ChainsCVE-2026-41272Highflowise: Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure)CVE-2026-41270Highflowise: Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function SandboxCVE-2026-41269Highflowise: Flowise: File Upload Validation Bypass in createAttachmentCVE-2026-41268Highflowise: Flowise: Parameter Override Bypass Remote Command ExecutionCVE-2026-41266Highflowise: Flowise: Sensitive Data Leak in public-chatbotConfig

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo