Skip to content
OpenAdvisories

Ecosystem

npm

7,703 known vulnerabilities.

Most affected packages

openclaw 589 n8n 156 parse-server 117 flowise 114 electron 79 vm2 78 next 77 ghost 62 directus 58 axios 55 undici 55 nocodb 54 hono 52 @budibase/server 42 apostrophe 35 node-forge 35 dompurify 33 pnpm 32 flowise-components 31 @anthropic-ai/claude-code 30 vite 29 payload 29 astro 29 nodemailer 27 nuxt 26 better-auth 26 devalue 25 handlebars 22 @openzeppelin/contracts-upgradeable 22 @xmldom/xmldom 22 tar 21 fuxa-server 21 tinymce 21 react-router 20 @openzeppelin/contracts 20 liquidjs 19 @sveltejs/kit 19 sequelize 18 @backstage/plugin-scaffolder-backend 17 sanitize-html 17
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Low 3.7
    CVE-2026-118776 Public exploit

    Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption

    Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used decipher.finish(), CBC and ECB modes, PKCS#7 padding to process the relevant input or security decision. node…

    digitalbazaar forge node-forge node-node-forge Ubuntu npm
  • Low 2.1
    CVE-2026-22706 Public exploit

    Strapi: Password Reset Does Not Revoke Existing Refresh Sessions

    Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, changing or resetting a user's password did not invalidate the user's existing refresh-token sessions by default. The refresh-token invalidation step in the users…

    strapi strapi @strapi/plugin-users-permissions @strapi/admin npm
  • Low 3.3
    CVE-2026-4040 Public exploit

    OpenClaw File Existence tools.exec.safeBins information exposure

    A vulnerability was identified in OpenClaw up to 2026.2.17. This issue affects the function tools.exec.safeBins of the component File Existence Handler. The manipulation leads to information exposure through discrepancy. The attack needs to be performed local…

    openclaw npm
  • Low 2.7
    CVE-2026-25050 Public exploit

    Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy

    Vendure is an open-source headless commerce platform. Prior to version 3.5.3, the `NativeAuthenticationStrategy.authenticate()` method is vulnerable to a timing attack that allows attackers to enumerate valid usernames (email addresses). In `packages/core/src…

    vendurehq vendure @vendure/core npm
  • Low 3.7
    CVE-2025-32421 Public exploit

    Next.js Race Condition to Cache Poisoning

    Next.js is a React framework for building full-stack web applications. Versions prior to 14.2.24 and 15.1.6 have a race-condition vulnerability. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve `pageP…

    vercel next.js next npm
  • Low 3.7
    CVE-2024-9506 Public exploit

    Regular Expression Denial of Service (ReDoS)

    Improper regular expression in Vue's parseHTML function leads to a potential regular expression denial of service vulnerability.

    vue vue vue npm
  • Low 3.5
    CVE-2017-20165 Public exploit

    debug-js debug node.js useColors redos

    A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version …

    debug-js debug debug node-debug Debian Ubuntu npm
  • Low 3.3
    CVE-2021-23358 Public exploit

    Arbitrary Code Injection

    The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

    underscore underscore underscore Debian Ubuntu npm
  • Low 3.5
    CVE-2020-15228 Public exploit

    Environment Variable Injection in GitHub Actions

    In the `@actions/core` npm module before version 1.2.6,`addPath` and `exportVariable` functions communicate with the Actions Runner over stdout by generating a string in a specific format. Workflows that log untrusted data to stdout may invoke these commands,…

    actions toolkit @actions/core npm