
npm
5,162,107 packages · npmjs.org
Moderate Security Advisories in npm Clear Filters
Moderate
5 months ago
QMarkdown Cross-Site Scripting (XSS) vulnerability
npm
@quasar/quasar-ui-qmarkdown
Moderate
6 months ago
Permission policy information leakage in Backstage permission system
npm
@backstage/plugin-permission-backend
Moderate
6 months ago
http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed
npm
http-proxy-middleware
Moderate
6 months ago
http-proxy-middleware can call writeBody twice because "else if" is not used
npm
http-proxy-middleware
Moderate
6 months ago
@sveltejs/kit vulnerable to Cross-site Scripting via tracked search_params
npm
@sveltejs/kit
Moderate
6 months ago
Koajs vulnerable to Cross-Site Scripting (XSS) at ctx.redirect() function
npm
koa
Moderate
6 months ago
ts-asn1-der has Incorrect DER Encoding of Numbers Leading to Denial of Service and Incorrect Value Representation
npm
@apeleghq/asn1-der
Moderate
6 months ago
estree-util-value-to-estree allows prototype pollution in generated ESTree
npm
estree-util-value-to-estree
Moderate
6 months ago
tarteaucitron.js allows url scheme injection via unfiltered inputs
npm
tarteaucitronjs
Moderate
6 months ago
tarteaucitron.js allows prototype pollution via custom text injection
npm
tarteaucitronjs
Moderate
6 months ago
tarteaucitron.js allows UI manipulation via unrestricted CSS injection
npm
tarteaucitronjs
Moderate
6 months ago
Vite allows server.fs.deny to be bypassed with .svg or relative paths
npm
vite
Moderate
6 months ago
expand-object Vulnerable to Prototype Pollution via the expand() Function
npm
expand-object
Moderate
6 months ago
aws-cdk-lib has Insertion of Sensitive Information into Log File vulnerability when using Cognito UserPoolClient Construct
npm
aws-cdk-lib
Moderate
6 months ago
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query
npm
vite
Moderate
6 months ago
Uptime Kuma's Regular Expression in pushdeeer and whapi file Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
npm
uptime-kuma
Moderate
6 months ago
Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]
npm
vega-functions, vega
Moderate
6 months ago
Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode expressionInterpeter
npm
vega-functions, vega
Moderate
6 months ago
Directus `search` query parameter allows enumeration of non permitted fields
npm
directus
Moderate
6 months ago
Directus's S3 assets become unavailable after a burst of HEAD requests
npm
directus, @directus/storage-driver-s3
Moderate
6 months ago
Directus's S3 assets become unavailable after a burst of malformed transformations
npm
directus, @directus/storage-driver-s3
Moderate
6 months ago
AWS CDK CLI prints AWS credentials retrieved by custom credential plugins
npm
cdk, aws-cdk
Moderate
7 months ago
JS Html Sanitizer allows XSS when used with contentEditable
npm
@jitbit/htmlsanitizer
Moderate
7 months ago
nest allows a remote attacker to execute arbitrary code via the Content-Type header
npm
@nestjs/common
Moderate
7 months ago
Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
npm
@babel/runtime-corejs3, @babel/runtime-corejs2, @babel/runtime, @babel/helpers
Moderate
7 months ago
NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Page
npm
nocodb
Moderate
7 months ago
MongoDB Shell may be susceptible to control character injection via pasting
npm
mongosh
Moderate
7 months ago
Beter Auth has an Open Redirect via Scheme-Less Callback Parameter
npm
better-auth
Moderate
7 months ago
Cross-site scripting (XSS) in the CKEditor 5 real-time collaboration package
npm
ckeditor5-premium-features, @ckeditor/ckeditor5-real-time-collaboration
Moderate
7 months ago
Directus allows updates to non-allowed fields due to overlapping policies
npm
@directus/api, directus
Moderate
8 months ago
@octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
npm
@octokit/request
Moderate
8 months ago
@octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
npm
@octokit/request-error
Moderate
8 months ago
@octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
npm
@octokit/plugin-paginate-rest
Moderate
8 months ago
@octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
npm
@octokit/endpoint
Moderate
8 months ago
Vega allows Cross-site Scripting via the vlSelectionTuples function
npm
vega-selections, vega
Moderate
8 months ago
esbuild enables any website to send any requests to the development server and read the response
npm
esbuild
Moderate
8 months ago
snowflake-sdk may incorrectly validate temporary credential cache file permissions
npm
snowflake-sdk
Moderate
8 months ago
Opening a malicious website while running a Nuxt dev server could allow read-only access to code
npm
@nuxt/rspack-builder, @nuxt/webpack-builder
Moderate
8 months ago
Opening a malicious website while running a Nuxt dev server could allow read-only access to code
npm
@nuxt/vite-builder
Moderate
8 months ago
XSS/HTML Injection Vulnerability in Umbraco Backoffice Components
npm, nuget
@umbraco-cms/backoffice, Umbraco.Cms.StaticAssets
Moderate
8 months ago
Infinite loop and Blind SSRF found inside the Webfinger mechanism in @fedify/fedify
npm
@fedify/fedify
Moderate
8 months ago
Websites were able to send any requests to the development server and read the response in vite
npm
vite
Moderate
9 months ago
parse-uri Regular expression Denial of Service (ReDoS)
npm
parseuri, parse-uri
Moderate
9 months ago
Marp Core allows XSS by improper neutralization of HTML sanitization
npm
@marp-team/marp-core
Moderate
10 months ago
uptime-kuma vulnerable to Local File Inclusion (LFI) via Improper URL Handling in `Real-Browser` monitor
npm
uptime-kuma
Moderate
10 months ago
Bun has an Application-level Prototype Pollution vulnerability in the runtime native API for Glo
npm
bun
Moderate
10 months ago
pnpm no-script global cache poisoning via overrides / `ignore-scripts` evasion
npm
pnpm
Moderate
10 months ago
Predictable results in nanoid generation when given non-integer values
npm
nanoid
Moderate
10 months ago
Backstage Scaffolder plugin vulnerable to Server-Side Request Forgery
npm
@backstage/plugin-scaffolder-node
Moderate
10 months ago
@intlify/shared Prototype Pollution vulnerability
npm
vue-i18n, @intlify/vue-i18n-core, @intlify/shared, petite-vue-i18n
Moderate
10 months ago
vue-i18n has cross-site scripting vulnerability with prototype pollution
npm
@intlify/vue-i18n-core, @intlify/core, vue-i18n, @intlify/core-base, petite-vue-i18n
Moderate
10 months ago
@dapperduckling/keycloak-connector-server has Reflected XSS Vulnerability in Authentication Flow URL Handling
npm
@dapperduckling/keycloak-connector-server
Moderate
10 months ago
smol-toml has a Denial of Service via malicious TOML document using deeply nested inline tables
npm
smol-toml
Moderate
11 months ago
Firebase JavaScript SDK allows attackers to manipulate the "_authTokenSyncURL" to point to their own server
npm
firebase
Moderate
11 months ago
matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal
npm
matrix-js-sdk
Moderate
11 months ago
Froala WYSIWYG editor allows cross-site scripting (XSS)
packagist, npm
froala/wysiwyg-editor, froala-editor
Moderate
11 months ago
CycloneDX cdxgen may execute code contained within build-related files
npm
@cyclonedx/cdxgen
Moderate
11 months ago
nope-validator Regular Expression Denial of Service vulnerability
npm
nope-validator
Moderate
11 months ago
validate.js Regular Expression Denial of Service vulnerability
npm
validate.js
Moderate
11 months ago
CommonRegexJS Regular Expression Denial of Service vulnerability
npm
commonregex
Moderate
11 months ago
Foundation Regular Expression Denial of Service vulnerability
npm
foundation-sites
Moderate
11 months ago
Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section
npm, nuget
@umbraco-cms/backoffice, Umbraco.Cms.StaticAssets
Moderate
12 months ago
Hono allows bypass of CSRF Middleware by a request without Content-Type header.
npm
hono
Filter by Severity
Filter by Package
directus
23
tinymce
14
next
12
TinyMCE
11
tinymce/tinymce
11
@openzeppelin/contracts-upgradeable
11
@openzeppelin/contracts
11
ghost
11
ckeditor4
11
electron
10
vite
10
joplin
10
angular
9
swagger-ui
9
editor.md
8
parse-server
8
n8n
7
validator
7
sanitize-html
7
nocodb
7
nodebb
7
marked
7
urijs
6
jquery-ui
6
url-parse
6
uptime-kuma
6
vega
6
bootstrap
6
org.webjars.npm:jquery-ui
6
jQuery.UI.Combined
6
snyk-broker
6
matrix-js-sdk
6
flowise
6
undici
6
@lobehub/chat
5
froala-editor
5
jquery
5
katex
5
@evershop/evershop
5
bootstrap-sass
5
matrix-appservice-irc
5
tarteaucitronjs
5
vditor
5
astro
4
vega-functions
4
materialize-css
4
dompurify
4
hono
4
rsshub
4
bootstrap
4
mermaid
4
yui
4
serve
4
trix
4
glance
4
@directus/api
4
matrix-react-sdk
4
jQuery
4
jose-node-cjs-runtime
3
moodle/moodle
3
systeminformation
3
strapi
3
jquery-ui-rails
3
next-auth
3
xlsx
3
sequelize
3
org.webjars:bootstrap
3
@intlify/vue-i18n-core
3
statics-server
3
jose
3
valine
3
@saltcorn/server
3
docsify
3
bootstrap-sass
3
follow-redirects
3
apollo-server-core
3
renovate
3
@jmondi/url-to-png
3
mattermost-desktop
3
jose-node-esm-runtime
3
@backstage/techdocs-common
3
parse-url
3
layui
3
dojo
3
public
3
bootstrap
3
org.webjars.npm:jquery
3
yapi-vendor
3
postcss
3
mysql
3
express
3
bootstrap.sass
3
petite-vue-i18n
3
m-server
3
@ckeditor/ckeditor5-markdown-gfm
3
hapi
3
vue-i18n
3
twbs/bootstrap
3
node-sass
2
express-xss-sanitizer
2
@escape.tech/graphql-armor-max-depth
2
@strapi/admin
2
element-plus
2
lodash
2
engine.io
2
@intlify/core-base
2
node-red-dashboard
2
pug-code-gen
2
lodash-es
2
request
2
http-file-server
2
status-board
2
html-janitor
2
nanoid
2
@openc3/tool-common
2
@strapi/strapi
2
handlebars
2
psitransfer
2
summernote
2
jszip
2
gitbook
2
svelte
2
i18next
2
reveal.js
2
querymen
2
aws-cdk-lib
2
simplehttpserver
2
apollo-server
2
pnpm
2
Umbraco.Cms.StaticAssets
2
@auth0/nextjs-auth0
2
openc3
2
simple-markdown
2
@adobe/css-tools
2
@astrojs/node
2
lodash-rails
2
bootbox
2
bodymen
2
bl
2
node-forge
2
axios
2
quill
2
notevil
2
@materializecss/materialize
2
highlight.js
2
swagger-ui-dist
2
ejs
2
ggit
2
@haxtheweb/haxcms-nodejs
2
openpgp
2
keycloak-connect
2
@fedify/fedify
2
@directus/storage-driver-s3
2
@braintree/sanitize-url
2
apostrophe
2
prismjs
2
@cloudflare/workers-oauth-provider
2
rendertron
2
@umbraco-cms/backoffice
2
stimulsoft-dashboards-js
2
jodit
2
forms
2
erxes
2
jsonwebtoken
2
jellyfin-web
2
serialize-javascript
2
mxgraph
2
parse
2
jspdf
2
saml2-js
2
nunjucks
2
harp
2
connect
2
webpack-dev-server
2
express-gateway
2
simditor
2
@vrite/sdk
2
@strapi/utils
2
nodemailer
2
karma
2
google-closure-library
2
@intlify/core
2
converse.js
2
@excalidraw/excalidraw
2
@strapi/plugin-content-manager
2
mcp-markdownify-server
2
http-proxy-middleware
2
aws-cdk
2
mongo-express
2
xmldom
2
@builder.io/qwik
2
tough-cookie
2
jsrsasign
2
@finastra/nestjs-proxy
2
mysql2
2
fastify
2
matrix-appservice-bridge
2
fast-jwt
2
sockjs
2
jose-browser-runtime
2
Filter by Repository
https://github.com/directus/directus
24
https://github.com/tinymce/tinymce
14
https://github.com/electron/electron
11
https://github.com/OpenZeppelin/openzeppelin-contracts
11
https://github.com/strapi/strapi
11
https://github.com/TryGhost/Ghost
10
https://github.com/ckeditor/ckeditor4
10
https://github.com/laurent22/joplin
10
https://github.com/vitejs/vite
10
https://github.com/backstage/backstage
10
https://github.com/vercel/next.js
10
https://github.com/parse-community/parse-server
8
https://github.com/pandao/editor.md
8
https://github.com/swagger-api/swagger-ui
8
https://github.com/vega/vega
7
https://github.com/jquery/jquery
7
https://github.com/n8n-io/n8n
7
https://github.com/nocodb/nocodb
7
https://github.com/matrix-org/matrix-js-sdk
6
https://github.com/NodeBB/NodeBB
6
https://github.com/nodejs/undici
6
https://github.com/louislam/uptime-kuma
6
https://github.com/FlowiseAI/Flowise
6
https://github.com/panva/jose
6
https://github.com/ckeditor/ckeditor5
5
https://github.com/unshiftio/url-parse
5
https://github.com/evershopcommerce/evershop
5
https://github.com/matrix-org/matrix-appservice-irc
5
https://github.com/lobehub/lobe-chat
5
https://github.com/withastro/astro
5
https://github.com/jquery/jquery-ui
5
https://github.com/apostrophecms/sanitize-html
5
https://github.com/KaTeX/KaTeX
5
https://github.com/apollographql/apollo-server
4
https://github.com/keystonejs/keystone
4
https://github.com/basecamp/trix
4
https://github.com/Dogfalo/materialize
4
https://github.com/honojs/hono
4
https://github.com/twbs/bootstrap
4
https://github.com/nextauthjs/next-auth
4
https://github.com/AmauriC/tarteaucitron.js
4
https://github.com/matrix-org/matrix-react-sdk
4
https://github.com/markedjs/marked
4
https://github.com/mermaid-js/mermaid
4
https://github.com/DIYgod/RSSHub
4
https://github.com/aws/aws-cdk
4
https://github.com/jasonraimondi/url-to-png
3
https://github.com/vanessa219/vditor
3
https://github.com/ionicabizau/parse-url
3
https://github.com/angular/angular.js
3
https://github.com/xCss/Valine
3
https://github.com/renovatebot/renovate
3
https://github.com/hapijs/hapi
3
https://github.com/sequelize/sequelize
3
https://github.com/froala/wysiwyg-editor
3
https://github.com/YMFE/yapi
3
https://github.com/sebhildebrandt/systeminformation
3
https://github.com/docsifyjs/docsify
3
https://github.com/follow-redirects/follow-redirects
3
https://github.com/postcss/postcss
3
https://github.com/haxtheweb/issues
3
https://github.com/cure53/DOMPurify
3
https://github.com/medialize/uri.js
3
https://github.com/jarofghosts/glance
3
https://github.com/eclipse-theia/theia
3
https://github.com/Escape-Technologies/graphql-armor
3
https://github.com/intlify/vue-i18n
3
https://github.com/cloudflare/workers-sdk
3
https://github.com/saltcorn/saltcorn
3
https://github.com/medialize/URI.js
3
https://github.com/nuxt/nuxt
3
https://github.com/kjur/jsrsasign
2
https://github.com/digitalbazaar/forge
2
https://github.com/moxiecode/plupload
2
https://github.com/highlightjs/highlight.js
2
https://github.com/mysqljs/mysql
2
https://github.com/keycloak/keycloak-nodejs-connect
2
https://github.com/pnpm/pnpm
2
https://github.com/webpack/webpack-dev-server
2
https://github.com/sidorares/node-mysql2
2
https://github.com/lodash/lodash
2
https://github.com/givanz/VvvebJs
2
https://github.com/yahoo/serialize-javascript
2
https://github.com/caolan/forms
2
https://github.com/chimurai/http-proxy-middleware
2
https://github.com/mde/ejs
2
https://github.com/openpgpjs/openpgpjs
2
https://github.com/rvagg/bl
2
https://github.com/expressjs/express
2
https://github.com/request/request
2
https://github.com/ai/nanoid
2
https://github.com/nestjs/nest
2
https://github.com/firebase/firebase-js-sdk
2
https://github.com/sass/node-sass
2
https://github.com/zcaceres/markdownify-mcp
2
https://github.com/google/closure-library
2
https://github.com/GoogleChrome/rendertron
2
https://github.com/VulnSageAgent/PoCs
2
https://github.com/guardian/html-janitor
2
https://github.com/fastify/fastify
2
https://github.com/excalidraw/excalidraw
2
https://github.com/facebook/react
2
https://github.com/punkave/sanitize-html
2
https://github.com/axios/axios
2
https://github.com/sveltejs/svelte
2
https://github.com/pugjs/pug
2
https://github.com/vendure-ecommerce/vendure
2
https://github.com/getsentry/sentry-javascript
2
https://github.com/koush/scrypted
2
https://github.com/Stuk/jszip
2
https://github.com/zeit/next.js
2
https://github.com/auth0/lock
2
https://github.com/quilljs/quill
2
https://github.com/mozilla/nunjucks
2
https://github.com/dahlia/fedify
2
https://github.com/payloadcms/payload
2
https://github.com/Vanessa219/vditor
2
https://github.com/summernote/summernote
2
https://github.com/auth0/node-jsonwebtoken
2
https://github.com/adobe/css-tools
2
https://github.com/vriteio/vrite
2
https://github.com/Urigo/graphql-mesh
2
https://github.com/chocobozzz/peertube
2
https://github.com/freshfish-hust/my-cves
2
https://github.com/nasa/openmct
2
https://github.com/karma-runner/karma
2
https://github.com/socketio/engine.io
2
https://github.com/MrRio/jsPDF
2
https://github.com/Khan/simple-markdown
2
https://github.com/josdejong/jsoneditor
2
https://github.com/umbraco/Umbraco-CMS
2
https://github.com/socketio/socket.io
2
https://github.com/braintree/sanitize-url
2
https://github.com/Finastra/finastra-nodejs-libs
2
https://github.com/salesforce/tough-cookie
2
https://github.com/apostrophecms/apostrophe
2
https://github.com/cloudflare/workers-oauth-provider
2
https://github.com/matrix-org/matrix-appservice-bridge
2
https://github.com/OpenC3/cosmos
2
https://github.com/nodemailer/nodemailer
2
https://github.com/jellyfin/jellyfin-web
2
https://github.com/i18next/i18next
2
https://github.com/xmldom/xmldom
2
https://github.com/AhmedAdelFahim/express-xss-sanitizer
2
https://github.com/erxes/erxes
2
https://github.com/auth0/nextjs-auth0
2
https://github.com/gatsbyjs/gatsby
2
https://github.com/psi-4ward/psitransfer
2
https://github.com/validatorjs/validator.js
2
https://github.com/jameswlane/status-board
2
https://github.com/nearform/fast-jwt
2
https://github.com/Uniswap/web3-react
1
https://github.com/GladysAssistant/Gladys
1
https://github.com/ajv-validator/ajv
1
https://github.com/colinhacks/zod
1
https://github.com/Zireael-N/node-weakauras-parser
1
https://github.com/auth0/angular-jwt
1
https://github.com/tristao-marinho/CVE-2023-41646
1
https://github.com/squirrelchat/smol-toml
1
https://github.com/manuelstofer/json-pointer
1
https://github.com/zowe/zowe-cli
1
https://github.com/knockout/knockout
1
https://github.com/indutny/elliptic
1
https://github.com/tj/node-cookie-signature
1
https://github.com/simonh1000/angular-http-server
1
https://github.com/hayageek/jquery-upload-file
1
https://github.com/TooTallNate/node-https-proxy-agent
1
https://github.com/DependencyTrack/frontend
1
https://github.com/LemonLDAPNG/node-lemonldap-ng-handler
1
https://github.com/arnog/mathlive
1
https://github.com/isomorphic-git/isomorphic-git
1
https://github.com/lukeed/dset
1
https://github.com/NetEase/pomelo
1
https://github.com/vuetifyjs/vuetify
1
https://github.com/netlify/netlify-ipx
1
https://github.com/algolia/algoliasearch-helper-js
1
https://github.com/silverwind/droppy
1
https://github.com/openwhisk/openwhisk-client-js
1
https://github.com/radashi-org/radashi
1
https://github.com/makeusabrew/bootbox
1
https://github.com/marp-team/marp-core
1
https://github.com/jpuri/react-draft-wysiwyg
1
https://github.com/autovance/ftp-srv
1
https://github.com/bpmn-io/diagram-js
1
https://github.com/okta/okta-oidc-middleware
1
https://github.com/koajs/koa
1
https://github.com/mhart/StringStream
1
https://github.com/auth0/passport-wsfed-saml2
1
https://github.com/minimistjs/minimist
1
https://github.com/BorisMoore/jsrender
1
https://github.com/fastify/fastify-swagger-ui
1
https://github.com/ceolter/ag-grid
1
https://github.com/ospfranco/link-preview-js
1
https://github.com/rhysd/Shiba
1
https://github.com/node-saml/passport-saml
1
https://github.com/samholmes/node-open-graph
1
https://github.com/directus/api
1
https://github.com/NervJS/taro
1
https://github.com/deoxxa/dotty
1