Tagged “npm”
CVEs tagged npm, newest first.
1010 CVEsRSS
CVE-2026-56762Medium· 5.3Hono missing validation of cookie name on write path in setCookie()
Hono missing validation of cookie name on write path in setCookie()
CVE-2026-32594MediumParse Server's GraphQL WebSocket endpoint bypasses security middleware
Parse Server's GraphQL WebSocket endpoint bypasses security middleware
CVE-2026-26318High· 8.8Command Injection via Unsanitized `locate` Output in `versions()` — systeminformation
Command Injection via Unsanitized `locate` Output in `versions()` — systeminformation
CVE-2026-21884High· 8.2React Router is a router for React
React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's <ScrollRestoration> API in Framework Mode when using the getKey/stora…
CVE-2025-59057High· 7.6PoCReact Router is a router for React
React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating s…
CVE-2025-61686Critical· 9.1PoCReact Router is a router for React
React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to version 2.17.2, if createFileSessionStorage() is being used from @react-router/…
CVE-2025-68113Medium· 6.5ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay
ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay
CVE-2025-64495High· 8.7PoCOpen WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE
Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE
CVE-2025-64496High· 7.3Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events
Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events
CVE-2025-11849Critical· 9.3Mammoth is vulnerable to Directory Traversal
Mammoth is vulnerable to Directory Traversal
CVE-2024-58351HighFlowise OverrideConfig security vulnerability
Flowise OverrideConfig security vulnerability
CVE-2024-39896High· 7.5Directus Allows Single Sign-On User Enumeration
Directus Allows Single Sign-On User Enumeration
CVE-2024-38355Medium· 7.3PoCsocket.io has an unhandled 'error' event
socket.io has an unhandled 'error' event
CVE-2024-38357Medium· 6.1TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements
TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements
CVE-2024-38356Medium· 6.1TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option
TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option
CVE-2024-21485Medium· 6.5PoCDash apps vulnerable to Cross-site Scripting
Dash apps vulnerable to Cross-site Scripting
CVE-2023-26154Medium· 5.9pubnub Insufficient Entropy vulnerability
pubnub Insufficient Entropy vulnerability
CVE-2024-21910Medium· 6.1Cross-site scripting vulnerability in TinyMCE plugins
Cross-site scripting vulnerability in TinyMCE plugins
CVE-2021-21423Medium· 6.8PoCRebuild-bot workflow may allow unauthorised repository modifications
Rebuild-bot workflow may allow unauthorised repository modifications
CVE-2019-11358Medium· 6.1⚠ ExploitedPoCXSS in jQuery as used in Drupal, Backdrop CMS, and other products
XSS in jQuery as used in Drupal, Backdrop CMS, and other products