Skip to content
OpenAdvisories

Ecosystem

npm

7,703 known vulnerabilities.

Most affected packages

openclaw 589 n8n 156 parse-server 117 flowise 114 electron 79 vm2 78 next 77 ghost 62 directus 58 axios 55 undici 55 nocodb 54 hono 52 @budibase/server 42 apostrophe 35 node-forge 35 dompurify 33 pnpm 32 flowise-components 31 @anthropic-ai/claude-code 30 vite 29 payload 29 astro 29 nodemailer 27 nuxt 26 better-auth 26 devalue 25 handlebars 22 @openzeppelin/contracts-upgradeable 22 @xmldom/xmldom 22 tar 21 fuxa-server 21 tinymce 21 react-router 20 @openzeppelin/contracts 20 liquidjs 19 @sveltejs/kit 19 sequelize 18 @backstage/plugin-scaffolder-backend 17 sanitize-html 17
All Critical High Medium Low Exploited only Public exploit

172 results · Clear filters · Feed

  • High 7.5
    CVE-2019-8903 Public exploit Scanner template EPSS 72%

    Path Traversal in total.js

    index.js in Total.js Platform before 3.2.3 allows path traversal.

    total.js npm
  • High 8.1
    CVE-2018-15685 Public exploit EPSS 10%

    Electron webPreferences vulnerability can be used to perform remote code execution

    GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a WebPreferences vulnerability that can be leveraged to perform remote code executio…

    electron npm
  • High 8.8
    CVE-2018-5158 Public exploit EPSS 10%

    Malicious PDF can inject JavaScript into PDF Viewer

    The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through a crafted PDF file. This JavaScript can then be run with the permissions of the PDF viewer by its worker. This vulnerability af…

    Mozilla Firefox Firefox ESR firefox Browsers Debian Ubuntu npm
  • High —
    CVE-2017-16086 Public exploit

    ReDoS via long UserAgent header in ua-parser

    ua-parser is a port of Browserscope's user agent parser. ua-parser is vulnerable to a ReDoS (Regular Expression Denial of Service) attack when given a specially crafted UserAgent header.

    HackerOne ua-parser node module ua-parser npm
  • High —
    CVE-2015-9238 Public exploit

    Insecure Comparison in secure-compare

    secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, meaning the check passed for any two strings of the same length.

    HackerOne secure-compare node module secure-compare npm
  • High —
    CVE-2016-10542 Public exploit

    DoS due to excessively large websocket message in ws

    ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly long websocket payload to a `ws` server, it is possible to crash the node process. This affects ws …

    HackerOne ws node module ws node-ws Debian Ubuntu npm
  • High 8.8
    CVE-2018-1000006 Public exploit EPSS 89%

    Remote Code Execution in electron

    GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the protocol handler, specifically Electron apps running on Windows 10, 7 or 2008 that register custom protocol handlers can be tricked in arbitra…

    electron npm
  • High 7.5
    CVE-2018-0114 Public exploit EPSS 43%

    Cisco node-jose improper validation of JWT signature

    A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature (J…

    node-jose npm
  • High 7.5
    CVE-2017-1000170 Public exploit Scanner template EPSS 59%

    jqueryFileTree vulnerable to Directory Traversal

    jqueryFileTree 2.1.5 and older Directory Traversal

    jqueryfiletree npm
  • High 8.8
    CVE-2017-16570 Public exploit

    Cross-Site Request Forgery (CSRF) in keystone

    KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF parameter and value, aka SecureLayer7 issue number SL7_KEYJS_03. In other words, it fails to reject requests that lack an x-csrf-token header.

    keystone npm
  • High 8.8
    CVE-2017-15879 Public exploit

    Keystone is vulnerable to CSV injection

    CSV Injection (aka Excel Macro Injection or Formula Injection) exists in admin/server/api/download.js and lib/list/getCSVData.js in KeystoneJS before 4.0.0-beta.7 via a value that is mishandled in a CSV export.

    keystone npm
  • High —
    CVE-2014-7192 Public exploit EPSS 13%

    Potential for Script Injection in syntax-error

    Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rational Application Developer and other products, allows remote attackers to execute arbitrary code via a crafted file.

    libv8-3.14 syntax-error Ubuntu npm