npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-41299Highopenclaw: OpenClaw: Gateway chat.send ACP-only provenance guard could be bypassed by client identity spoofing CVE-2026-41344Mediumopenclaw: OpenClaw: Gateway `operator.write` can reach admin-only persisted `verboseLevel` via `chat.send` `/verbose`CVE-2026-41332Mediumopenclaw: OpenClaw host-env blocklist missing `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE` allows code execution via env override GHSA-JCCR-RRW2-VC8HHighopenclaw: OpenClaw safeBins jq `$ENV` filter bypass allows environment variable disclosure CVE-2026-33581Highopenclaw: OpenClaw's message tool media parameter bypasses tool policy filesystem isolation CVE-2026-41399Mediumopenclaw: OpenClaw: Gateway WebSocket Denial of Service via unbounded pre-auth upgrades CVE-2026-41363Mediumopenclaw: OpenClaw: Feishu extension resolveUploadInput bypasses file-system sandbox and allows arbitrary file reads via upload_image CVE-2026-41303Highopenclaw: OpenClaw: Discord text `/approve` bypasses `channels.discord.execApprovals.approvers` and allows non-approvers to resolve pending exec…CVE-2026-34503Highopenclaw: OpenClaw's device removal and token revocation do not terminate active WebSocket sessions CVE-2026-41342Highopenclaw: OpenClaw: CLI Remote Onboarding Persists Unauthenticated Discovery Endpoint and Exfiltrates Gateway Credentials CVE-2026-33576Mediumopenclaw: OpenClaw: Zalo channel downloads media before sender authorization CVE-2026-33579Criticalopenclaw: OpenClaw: /pair approve command path omitted caller scope subsetting and reopened device pairing escalation CVE-2026-41395Highopenclaw: OpenClaw: Voice-call Plivo V3 webhook replay key uses unsorted URL, allowing replay via query-parameter reordering CVE-2026-34573Highparse-server: parse-server has GraphQL complexity validator exponential fragment traversal DoS CVE-2026-34532Criticalparse-server: parse-server has cloud function validator bypass via prototype chain traversal CVE-2026-34405Mediumnuxt-og-image: Nuxt OG Image is vulnerable to reflected XSS via query parameter injection into HTML attributes GHSA-PQHR-MP3F-HRPPMediumnuxt-og-image: Nuxt OG Image vulnerable to Server-Side Request Forgery via user-controlled parameters CVE-2026-34404Mediumnuxt-og-image: Nuxt OG Image is vulnerable to Denial of Service via unbounded image dimensions CVE-2026-35620Mediumopenclaw: OpenClaw: Non-owner command-authorized sender can change the owner-only `/send` session delivery policy CVE-2026-35653Highopenclaw: OpenClaw: `browser.request` still allows `POST /reset-profile` through the `operator.write` surface GHSA-VQVG-86CC-CG83Mediumopenclaw: OpenClaw: Mutating internal `/allowlist` chat commands missed `operator.admin` scope enforcement CVE-2026-35621Highopenclaw: OpenClaw: Gateway operator.write Can Reach Admin-Class Channel Allowlist Persistence via chat.send CVE-2026-35641Highopenclaw: OpenClaw has an Arbitrary Malicious Code Execution Vulnerability CVE-2026-35619Mediumopenclaw: OpenClaw has a Gateway HTTP /v1/models Route Bypasses Operator Read Scope CVE-2026-35665Mediumopenclaw: OpenClaw has incomplete Fix for CVE-2026-32011: Feishu Webhook Pre-Auth Body Parsing DoS (Slow-Body / Slowloris Variant)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo