npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-39885Highmcp-from-openapi: mcp-from-openapi is Vulnerable to SSRF via $ref Dereferencing in Untrusted OpenAPI SpecificationsCVE-2026-39865Mediumaxios: Axios HTTP/2 Session Cleanup State Corruption VulnerabilityGHSA-VVJJ-XCJG-GR5GMediumnodemailer: Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO) CVE-2026-39859Mediumliquidjs: LiquidJS: `renderFile()` / `parseFile()` bypass configured `root` and allow arbitrary file readCVE-2026-39412Mediumliquidjs: LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channelCVE-2026-39411Medium@lobehub/lobehub: LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` headerCVE-2026-35525Highliquidjs: LiquidJS: Root restriction bypass for partial and layout loading through symlinked templatesCVE-2026-34166Lowliquidjs: LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` FilterCVE-2026-39410Mediumhono: Hono: Non-breaking space prefix bypass in cookie name handling in getCookie()CVE-2026-39409Mediumhono: Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addressesCVE-2026-56762Mediumhono: Hono missing validation of cookie name on write path in setCookie()CVE-2026-39408Mediumhono: Hono: Path traversal in toSSG() allows writing files outside the output directoryCVE-2026-39407Mediumhono: Hono: Middleware bypass via repeated slashes in serveStaticCVE-2026-39406Medium@hono/node-server: @hono/node-server: Middleware bypass via repeated slashes in serveStaticCVE-2026-39398Mediumopenclaw-claude-bridge: openclaw-claude-bridge: sandbox is not effective - `--allowed-tools ""` does not restrict available toolsCVE-2026-39397Critical@delmaredigital/payload-puck: @delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered…CVE-2026-39356Highdrizzle-orm: Drizzle ORM has SQL injection via improperly escaped SQL identifiersCVE-2026-39381Mediumparse-server: Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields`CVE-2026-39371Highrwsdk: RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requestsGHSA-5G3J-89FR-R2VPMediumskilleton: skilleton has improper input handling in repository/path processingCVE-2026-39321Mediumparse-server: Parse Server has a login timing side-channel reveals user existenceCVE-2026-35613Mediumcoursevault-preview: coursevault-preview has a path traversal due to improper base-directory boundary validationCVE-2025-56015Highgenieacs: GenieACS has an unauthenticated access vulnerability via the NBI API endpointCVE-2026-40045Mediumopenclaw: OpenClaw: Android accepted cleartext remote gateway endpoints and sent stored credentials over ws://CVE-2026-41407Mediumopenclaw: OpenClaw: Shared-secret comparison call sites leaked length information through timing

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo