npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-35668Highopenclaw: OpenClaw has Sandbox Media Root Bypass via Unnormalized `mediaUrl` / `fileUrl` Parameter Keys (CWE-22)CVE-2026-35667Mediumopenclaw: OpenClaw has incomplete Fix for CVE-2026-27486: Unvalidated SIGKILL in `!stop` Chat Command via `shell-utils.ts`CVE-2026-34373Mediumparse-server: GraphQL API endpoint ignores CORS origin restrictionCVE-2026-34363Highparse-server: LiveQuery protected field leak via shared mutable state across concurrent subscribersCVE-2026-34156Critical@nocobase/plugin-workflow-javascript: NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script NodeCVE-2026-33949High@tinacms/graphql: @tinacms/graphql has Path Traversal that leads to overwrite of arbitrary filesCVE-2026-35651Mediumopenclaw: OpenClaw has ACP CLI approval prompt ANSI escape sequence injectionCVE-2026-35661Mediumopenclaw: OpenClaw: Telegram DM-Scoped Inline Button Callbacks Bypass DM Pairing and Mutate Session StateCVE-2026-35646Mediumopenclaw: OpenClaw: Synology Chat Webhook Pre-Auth Rate-Limit Bypass Enables Brute-Force Guessing of Webhook TokenCVE-2026-35654Mediumopenclaw: OpenClaw: MS Teams Feedback Invocation Bypasses Sender Allowlists and Records Unauthorized Session FeedbackCVE-2026-35645Mediumopenclaw: OpenClaw: Gateway Plugin Subagent Fallback `deleteSession` Uses Synthetic `operator.admin`CVE-2026-35664Mediumopenclaw: OpenClaw: Feishu Raw Card Send Surface Can Mint Legacy Card Callbacks That Bypass DM PairingCVE-2026-35640Mediumopenclaw: OpenClaw: Feishu webhook reads and parses unauthenticated request bodies before signature validationCVE-2026-35629Highopenclaw: OpenClaw: SSRF via Unguarded Configured Base URLs in Multiple Channel Extensions (Incomplete Fix for CVE-2026-28476)CVE-2026-35617Lowopenclaw: OpenClaw: Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayNameGHSA-Q2QC-744P-66R2Highopenclaw: OpenClaw: `session_status` sessionId resolution bypasses sandboxed session-tree visibilityCVE-2026-35657Mediumopenclaw: OpenClaw: Gateway HTTP Session History Route Bypasses Operator Read ScopeCVE-2026-34221High@mikro-orm/core: MikroORM has Prototype Pollution in Utils.mergeCVE-2026-34220Critical@mikro-orm/core: MikroORM is vulnerable to SQL Injection via specially crafted objectGHSA-7FQQ-Q52P-2JJGMediumopencc: OpenCC has an Out-of-bounds read when processing truncated UTF-8 inputCVE-2026-34226Highhappy-dom: Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookiesCVE-2026-34224Lowparse-server: Parse Server has an MFA single-use token bypass via concurrent authData login requestsCVE-2026-73427Lowtrix: Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop (Level0InputController)GHSA-7RX3-28CR-V5WHMediumhandlebars: Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist EntryGHSA-442J-39WM-28R2Lowhandlebars: Handlebars.js has a Property Access Validation Bypass in container.lookup

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo