npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-34425Mediumopenclaw: OpenClaw's complex interpreter pipelines could skip exec script preflight validationCVE-2026-39365Mediumvite: Vite Vulnerable to Path Traversal in Optimized Deps `.map` HandlingCVE-2026-39364Highvite: Vite: `server.fs.deny` bypassed with queriesCVE-2026-39363Highvite: Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocketCVE-2026-35515Medium@nestjs/core: @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')CVE-2026-5602Low@nor2/heim-mcp: @nor2/heim-mcp vulnerable to command injectionCVE-2026-5603Low@elgentos/magento2-dev-mcp: @elgentos/magento2-dev-mcp vulnerable to command injectionCVE-2026-34511Highopenclaw: OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameterCVE-2026-35209Highdefu: defu: Prototype pollution via `__proto__` key in defaults argumentCVE-2026-35442Highdirectus: Directus: Authenticated Users Can Extract Concealed Fields via Aggregate QueriesGHSA-6Q22-G298-GRJHHighdirectus: Directus: Unauthenticated Denial of Service via GraphQL Alias Amplification of Expensive Health Check ResolverCVE-2026-35441Mediumdirectus: Directus: GraphQL Alias Amplification Denial of Service Due to Missing Query Cost/Complexity LimitsCVE-2026-39943Mediumdirectus: Directus: Sensitive fields exposed in revision historyCVE-2026-35412Highdirectus: Directus: TUS Upload Authorization Bypass Allows Arbitrary File OverwriteCVE-2026-35409Highdirectus: Directus: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File ImportCVE-2026-35413Mediumdirectus: Directus: GraphQL Schema SDL Disclosure SettingCVE-2026-35410Mediumdirectus: Directus: Open Redirect via Parser Bypass in OAuth2/SAML Authentication FlowCVE-2026-35411Mediumdirectus: Directus: Open Redirect in Admin 2FA Setup PageCVE-2026-39942Highdirectus: Directus: Path Traversal and Broken Access Control in File Management APICVE-2026-35408Highdirectus: Directus: Missing Cross-Origin Opener PolicyCVE-2026-35216Critical@budibase/server: Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation StepCVE-2026-35214High@budibase/server: Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file writeCVE-2026-35394High@mobilenext/mobile-mcp: @mobilenext/mobile-mcp: Arbitrary Android Intent Execution via mobile_open_urlGHSA-5JG4-P4QW-CGFRHigh@stablelib/cbor: @stablelib/cbor: Stack exhaustion Denial of Service via deeply nested CBOR arrays, maps, or tagsGHSA-W48F-FWG7-WW6PHigh@stablelib/cbor: @stablelib/cbor: Prototype poisoning via `__proto__` map keys in CBOR decoding

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo