Skip to content
OpenAdvisories

Ecosystem

npm

7,727 known vulnerabilities.

Most affected packages

openclaw 589 n8n 156 parse-server 117 flowise 114 electron 79 vm2 78 next 77 ghost 62 directus 58 hono 57 axios 55 undici 55 nocodb 54 @budibase/server 42 apostrophe 35 node-forge 35 dompurify 33 pnpm 32 flowise-components 31 astro 31 @anthropic-ai/claude-code 30 vite 29 payload 29 nodemailer 27 nuxt 26 better-auth 26 devalue 25 handlebars 22 @openzeppelin/contracts-upgradeable 22 @xmldom/xmldom 22 tar 21 fuxa-server 21 tinymce 21 react-router 20 @openzeppelin/contracts 20 @sveltejs/kit 20 liquidjs 19 sequelize 18 signalk-server 17 @backstage/plugin-scaffolder-backend 17
All Critical High Medium Low Exploited only Public exploit

403 results · Clear filters · Feed

  • Low 3.1
    CVE-2015-1164

    Open Redirect in serve-static

    Open redirect vulnerability in the serve-static plugin before 1.7.2 for Node.js, when mounted at the root, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // (slash slash) followed by a domain in the PATH_IN…

    nodejs-nodemon serve-static node-serve-static Debian Azure Linux npm
  • Low —
    CVE-2014-6394

    Directory Traversal in send

    visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access restricted directories, as demonstrated using "public-restricted" under a "public" direc…

    send node-send node-send Debian Ubuntu npm
  • Low —
    CVE-2013-4116

    Local Privilege Escalation in npm

    lib/npm.js in Node Packaged Modules (npm) before 1.3.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names that are created when unpacking archives.

    npm npm Debian npm