Tagged “npm”
CVEs tagged npm, newest first.
1010 CVEsRSS
CVE-2026-48714Critical· 9.1i18next-http-middleware: MissingKeyHandler does not reject keys whose segments contain prototype-polluting names
i18next-http-middleware: MissingKeyHandler does not reject keys whose segments contain prototype-polluting names
CVE-2026-48713Critical· 9.1i18next-fs-backend vulnerable to prototype pollution via crafted missing-key string
i18next-fs-backend vulnerable to prototype pollution via crafted missing-key string
GHSA-wrr4-782v-jhwhLowneotoma has tenant isolation gap in relationship query endpoints
neotoma has tenant isolation gap in relationship query endpoints
CVE-2026-12537High· 7.8⚖ disputedImproper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action (versions prior to 0.1.22) on headless CI platforms allows an unprivileged attacker …
Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action (versions prior to 0.1.22) on headless CI platforms allows an unprivileged attacker …
GHSA-55cm-p4ww-685gMedium· 5.3Duplicate Advisory: Hono missing validation of cookie name on write path in setCookie()
Duplicate Advisory: Hono missing validation of cookie name on write path in setCookie()
GHSA-w4hm-rrxg-pxcfMedium· 7.1Duplicate Advisory: Flowise Execute Flow function has an SSRF vulnerability
Duplicate Advisory: Flowise Execute Flow function has an SSRF vulnerability
GHSA-2x6f-57hp-86fxMedium· 5.5Duplicate Advisory: Nuxt dev server vite-node IPC socket is world-connectable on Linux
Duplicate Advisory: Nuxt dev server vite-node IPC socket is world-connectable on Linux
CVE-2026-12866Critical· 9.8expr-eval vulnerable to Code Execution
expr-eval vulnerable to Code Execution
CVE-2026-54350Critical· 10.0PoCBudibase has nonymous NoSQL operator injection via published-app query templates
Budibase has nonymous NoSQL operator injection via published-app query templates
CVE-2026-53550Medium· 5.3js-yaml: js-yaml: Denial of Service via crafted YAML merge keys (CVE-2026-53550)
A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker can exploit this vulnerability by providing a specially crafted YAML document that repeatedly uses the same alias in a merge sequence. This can lead to alg…
CVE-2026-46672Medium· 4.6@actual-app/cli `--format csv` Output Vulnerable to CSV Formula Injection via Custom `escapeCsv` Helper
@actual-app/cli `--format csv` Output Vulnerable to CSV Formula Injection via Custom `escapeCsv` Helper
CVE-2026-46700Medium· 4.3@actual-app/sync-server's missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets
@actual-app/sync-server's missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets
CVE-2026-48153High· 8.5Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata
Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata
GHSA-hvqh-jw65-wcpqMedium· 5.4devbridge-autocomplete has XSS in its default formatters: formatGroup and formatResult fail to escape HTML in untrusted inputs
devbridge-autocomplete has XSS in its default formatters: formatGroup and formatResult fail to escape HTML in untrusted inputs
CVE-2026-50132High· 7.3Budibase has an Account Impersonation Issue — Chat Identity Link Hijacking via Missing Consent & CSRF
Budibase has an Account Impersonation Issue — Chat Identity Link Hijacking via Missing Consent & CSRF
CVE-2026-50136High· 7.4Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials
Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials
CVE-2026-50137HighBudibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials
Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials
CVE-2026-49229High· 8.3@actual-app/sync-server: Disabled OpenID users keep access through existing session tokens
@actual-app/sync-server: Disabled OpenID users keep access through existing session tokens
CVE-2026-54351High· 8.2Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override
Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override
CVE-2026-54352Critical· 9.6Budibase has arbitrary file read by workspace-builder via PWA-zip symlink upload
Budibase has arbitrary file read by workspace-builder via PWA-zip symlink upload
CVE-2026-54353High· 8.5@budibase/backend-core has potential SSRF DNS rebinding bypass in outbound fetch validation
@budibase/backend-core has potential SSRF DNS rebinding bypass in outbound fetch validation
CVE-2026-50179Medium· 4.2@actual-app/web has CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields
@actual-app/web has CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields
GHSA-5w6g-rc45-wvv9Critical· 9.8Duplicate Advisory: Flowise OverrideConfig security vulnerability
Duplicate Advisory: Flowise OverrideConfig security vulnerability
GHSA-xppm-jmw6-fhmfLowDuplicate Advisory: Cross-site scripting via <NoScript> slot content in Nuxt's head components
Duplicate Advisory: Cross-site scripting via <NoScript> slot content in Nuxt's head components
CVE-2026-12644Medium· 5.3ts-deepmerge: Prototype Method Override leads to DoS
ts-deepmerge: Prototype Method Override leads to DoS
CVE-2026-48814Critical· 9.1Network-AI: CVE-2026-46701 fix incomplete — empty default secret still authorizes all requests
Network-AI: CVE-2026-46701 fix incomplete — empty default secret still authorizes all requests
CVE-2026-54051Critical· 9.9Network-AI: Improper Neutralization of Special Elements used in an OS Command
Network-AI: Improper Neutralization of Special Elements used in an OS Command
CVE-2026-6733Low· 3.7undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse
undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse
CVE-2026-9679Medium· 5.9undici vulnerable to HTTP header injection via Set-Cookie percent-decoding
undici vulnerable to HTTP header injection via Set-Cookie percent-decoding
CVE-2026-11525Low· 3.7undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching
undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching