npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-41376Lowopenclaw: OpenClaw: Matrix thread root and reply context bypass sender allowlistCVE-2026-41336Highopenclaw: OpenClaw: Workspace `.env` can override the bundled hooks root and load attacker hook codeCVE-2026-41406Mediumopenclaw: OpenClaw: Feishu thread history and quoted messages bypass sender allowlistCVE-2026-41329Criticalopenclaw: OpenClaw: Heartbeat context inheritance bypasses sandbox via senderIsOwner escalationCVE-2026-41402Lowopenclaw: OpenClaw: Zalo webhook replay cache cross-target messageId scope bypassCVE-2026-41385Mediumopenclaw: OpenClaw Nostr privateKey config redaction bypass leaks plaintext signing key via config.getCVE-2026-41391Highopenclaw: OpenClaw: PIP_INDEX_URL and UV_INDEX_URL bypass host exec env sanitization and redirect Python package-index trafficCVE-2026-41337Mediumopenclaw: OpenClaw: Voice-call Plivo replay mutates in-process callback origin before replay rejectionCVE-2026-41394Mediumopenclaw: OpenClaw: Unauthenticated plugin-auth HTTP routes receive operator runtime scopesCVE-2026-34950Criticalfast-jwt: fast-jwt: Incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public KeyGHSA-3HFP-GQGH-XC5GCritical@lightdash/cli: Axios supply chain attack - dependency in @lightdash/cli may resolve to compromised axios versionsCVE-2026-34841Critical@usebruno/cli: Axios npm Supply Chain Incident Impacting @usebruno/cliCVE-2026-5327Lowfast-filesystem-mcp: fast-filesystem-mcp is vulnerable to command injection through handleGetDiskUsage functionCVE-2026-5323Lowa11y-mcp: a11y-mcp: Server-Side Request Forgery (SSRF) vulnerability in A11yServer functionGHSA-W2FM-25VW-VH7FHighmcp-handler: mcp-handler has a tool response leak across concurrent client sessions ('Race Condition')CVE-2026-4800Highlodash: lodash vulnerable to Code Injection via `_.template` imports key namesCVE-2026-2950Mediumlodash: lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAtCVE-2026-34825High@nocobase/plugin-workflow-sql: NocoBase Has SQL Injection via template variable substitution in workflow SQL nodeCVE-2026-34784Highparse-server: Parser Server's streaming file download bypasses afterFind file trigger authorizationCVE-2026-34752HighHaraka: Haraka affected by DoS via `__proto__` email headerCVE-2026-34725Highdbgate-web: dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configurationGHSA-X3FF-W252-2G7JMedium@stablelib/ed25519: StableLib Ed25519 Signature Malleability via Missing S < L CheckCVE-2026-34750Medium@payloadcms/storage-azure: Payload has Insufficient Filename Validation in Client-Upload Signed-URL EndpointsCVE-2026-34526Mediumsillytavern: SillyTavern: Incomplete IP validation in /api/search/visit allows SSRF via localhost and IPv6CVE-2026-34524Highsillytavern: SillyTavern: Path Traversal in `/api/chats/export` and `/api/chats/delete` allows arbitrary file read/delete within user data root

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo