Skip to content
OpenAdvisories

Ecosystem

npm

7,703 known vulnerabilities.

Most affected packages

openclaw 589 n8n 156 parse-server 117 flowise 114 electron 79 vm2 78 next 77 ghost 62 directus 58 axios 55 undici 55 nocodb 54 hono 52 @budibase/server 42 apostrophe 35 node-forge 35 dompurify 33 pnpm 32 flowise-components 31 @anthropic-ai/claude-code 30 vite 29 payload 29 astro 29 nodemailer 27 nuxt 26 better-auth 26 devalue 25 handlebars 22 @openzeppelin/contracts-upgradeable 22 @xmldom/xmldom 22 tar 21 fuxa-server 21 tinymce 21 react-router 20 @openzeppelin/contracts 20 liquidjs 19 @sveltejs/kit 19 sequelize 18 @backstage/plugin-scaffolder-backend 17 sanitize-html 17
All Critical High Medium Low Exploited only Public exploit

443 results · Clear filters · Feed

  • Critical —
    CVE-2013-4660 Public exploit EPSS 17%

    Deserialization Code Execution in js-yaml

    The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote attackers to execute arbitrary code via a crafted string that triggers an eval operation.

    js-yaml npm
  • Medium —
    CVE-2011-1714 Public exploit

    QooxDoo XSS in Callback Parameter

    Cross-site scripting (XSS) vulnerability in framework/source/resource/qx/test/jsonp_primitive.php in QooxDoo 1.3 and possibly other versions, as used in eyeOS 2.2 and 2.3, and possibly other products allows remote attackers to inject arbitrary web script or H…

    qooxdoo npm
  • Medium —
    CVE-2010-2273 Public exploit

    Cross-Site Scripting in dojo

    Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly …

    dojo dojo Debian npm