npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-113660Mediumapostrophe: ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft IdentifiersCVE-2026-113662Medium@apostrophecms/import-export: ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified documentCVE-2026-113659Mediumapostrophe: ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated usersCVE-2026-113710Mediumapostrophe: ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password GuessingCVE-2026-113661Mediumsanitize-html: ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLsCVE-2026-113668Mediumapostrophe: ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated…CVE-2026-113670Mediumapostrophe: ApostropheCMS: Page REST API authorization bypassCVE-2026-113671Medium@apostrophecms/ai-helper: ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRFCVE-2026-113658Highapostrophe: ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directoryCVE-2026-113669Mediumapostrophe: ApostropheCMS: Cross-domain session token in URL confers session takeoverCVE-2026-113656Medium@apostrophecms/form: ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoSCVE-2026-113667Medium@apostrophecms/form: ApostropheCMS: CAPTCHA response token not URL-encodedCVE-2026-113655Mediumapostrophe: ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorizationCVE-2026-113666High@apostrophecms/db-connect: ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of…CVE-2026-113654Mediumsanitize-html: ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content renderCVE-2026-111756Highfollow-redirects: follow-redirects array-form headers bypass cross-origin credential strippingCVE-2026-111755Highfollow-redirects: follow-redirects sensitiveHeaders regex escaping can expose credential headersCVE-2026-111751High@angular/router: @angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)CVE-2026-111752High@angular/router: @angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)CVE-2026-111757Mediumhono: Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static pathsCVE-2026-111754Medium@angular/platform-server: @angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)CVE-2026-111759Highmarkdown-it: markdown-it: Quadratic complexity in smartquotes with unmatched closing quotesCVE-2026-76894Low@aborruso/ckan-mcp-server: ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)CVE-2026-102989Critical@tanstack/start-server-core: TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responsesCVE-2026-86063High@anthropic-ai/claude-code: Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo