Skip to content
OpenAdvisories

Ecosystem

npm

7,703 known vulnerabilities.

Most affected packages

openclaw 589 n8n 156 parse-server 117 flowise 114 electron 79 vm2 78 next 77 ghost 62 directus 58 axios 55 undici 55 nocodb 54 hono 52 @budibase/server 42 apostrophe 35 node-forge 35 dompurify 33 pnpm 32 flowise-components 31 @anthropic-ai/claude-code 30 vite 29 payload 29 astro 29 nodemailer 27 nuxt 26 better-auth 26 devalue 25 handlebars 22 @openzeppelin/contracts-upgradeable 22 @xmldom/xmldom 22 tar 21 fuxa-server 21 tinymce 21 react-router 20 @openzeppelin/contracts 20 liquidjs 19 @sveltejs/kit 19 sequelize 18 @backstage/plugin-scaffolder-backend 17 sanitize-html 17
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.3
    CVE-2025-31125 Exploited Public exploit EPSS 75%

    Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query

    Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This…

    vitejs vite vite npm
    KEV Jan 22, 2026
  • Medium 6.9
    CVE-2020-11023 Exploited Public exploit EPSS 85%

    Potential XSS vulnerability in jQuery

    In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute unt…

    jquery jQuery drupal7 cacti Debian Ubuntu Alpine npm Packagist Maven NuGet RubyGems
    KEV Jan 23, 2025
  • Medium 6.5
    CVE-2019-5786 Exploited Public exploit EPSS 61%

    Use-After-Free in puppeteer

    Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.

    Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine npm
    KEV May 23, 2022