npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-34523Mediumsillytavern: SillyTavern: Path Traversal allows file existence oracleCVE-2026-34522Highsillytavern: SillyTavern has a path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directoryCVE-2026-34749Mediumpayload: Payload has a CSRF Protection Bypass in Authentication FlowCVE-2026-34746Highpayload: Payload has Authenticated SSRF via Upload FunctionalityCVE-2026-34748High@payloadcms/next: @payloadcms/next has Stored XSS in Admin PanelCVE-2026-34747Highpayload: Payload has an SQL Injection via Query HandlingCVE-2026-34451Medium@anthropic-ai/sdk: Claude SDK for TypeScript: Memory Tool Path Validation Allows Sandbox Escape to Sibling DirectoriesCVE-2026-2265Mediumreplicator: Replicator deserializes untrusted user inputCVE-2026-34751Criticalpayload: Payload: Pre-Authentication Account Takeover via Parameter Injection in Password RecoveryCVE-2026-34604High@tinacms/graphql: @tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or JunctionsCVE-2026-34603High@tinacms/graphql: @tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or JunctionsCVE-2026-34601Highxmldom: xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertionCVE-2026-34595Mediumparse-server: Parse Server has a LiveQuery protected-field guard bypass via array-like logical operator valueCVE-2026-34574Mediumparse-server: Parse Server has a session field immutability bypass via falsy-value guardCVE-2026-41294Criticalopenclaw: OpenClaw has a CWD `.env` environment variable injection which bypasses host-env policy and allows config takeoverCVE-2026-41380Highopenclaw: OpenClaw gateway exec allow-always over-trusts positional carrier executablesCVE-2026-34504Lowopenclaw: OpenClaw affected by SSRF via unguarded image download in fal providerCVE-2026-33578Mediumopenclaw: OpenClaw: Google Chat and Zalouser group sender allowlist bypass via policy downgradeGHSA-5R8F-96GM-5J6GHighopenclaw: OpenClaw Gateway `operator.write` can reach admin-only session reset via `chat.send` `/reset`CVE-2026-33577Mediumopenclaw: OpenClaw: node.pair.approve missing callerScopes validation allows low-privilege operator to approve malicious nodesCVE-2026-41390Highopenclaw: OpenClaw has a gateway exec allowlist allow-always bypass via unregistered /usr/bin/script wrapperCVE-2026-41387Highopenclaw: OpenClaw's incomplete host env sanitization blocklist allows supply-chain redirection via package-manager env overridesCVE-2026-33580Mediumopenclaw: OpenClaw's Nextcloud Talk webhook missing rate limiting on shared secret authenticationGHSA-G86V-F9QV-RH6MLowopenclaw: OpenClaw SSRF guard misses four IPv6 special-use rangesGHSA-JP4J-Q5FC-58GVMediumopenclaw: OpenClaw's Discord component interaction ingress skips guild/channel policy enforcement

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo