Skip to content
OpenAdvisories

Ecosystem

npm

7,717 known vulnerabilities.

Most affected packages

openclaw 589 n8n 156 parse-server 117 flowise 114 electron 79 vm2 78 next 77 ghost 62 directus 58 hono 57 axios 55 undici 55 nocodb 54 @budibase/server 42 apostrophe 35 node-forge 35 dompurify 33 pnpm 32 flowise-components 31 @anthropic-ai/claude-code 30 vite 29 payload 29 astro 29 nodemailer 27 nuxt 26 better-auth 26 devalue 25 handlebars 22 @openzeppelin/contracts-upgradeable 22 @xmldom/xmldom 22 tar 21 fuxa-server 21 tinymce 21 react-router 20 @openzeppelin/contracts 20 liquidjs 19 @sveltejs/kit 19 sequelize 18 signalk-server 17 @backstage/plugin-scaffolder-backend 17
All Critical High Medium Low Exploited only Public exploit

2,771 results · Clear filters · Feed

  • Medium —
    CVE-2014-4671 Public exploit EPSS 22%

    Rosetta-Flash JSONP Vulnerability in hapi

    Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11.2.202.394 on Linux, Adobe AIR before 14.0.0.137 on Android, Adobe AIR SDK before 14.0.0.137, and Adobe AIR SDK & Compiler before 14.0.0.137 do not properly restr…

    flashplugin-nonfree hapi Ubuntu npm
  • Medium —
    CVE-2013-2022

    jplayer Cross Site Scripting vulnerability

    Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.2.23 allow remote attackers to inject arbitrary web script or HTML via the (1) jQuery or (2) id parameters, a different…

    jplayer jplayer Ubuntu npm
  • Medium —
    CVE-2013-4940

    YUI Cross-site Scripting (XSS) vulnerability

    Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.10.2, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers…

    moodle/moodle yui npm Packagist
  • Medium —
    CVE-2013-4939

    Cross-Site Scripting in yui

    Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.0.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows rem…

    yui npm
  • Medium —
    CVE-2013-4941

    YUI Cross-site Scripting (XSS) vulnerability

    Cross-site scripting (XSS) vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 3.2.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows…

    moodle/moodle yui npm Packagist
  • Medium —
    CVE-2013-4942

    YUI Cross-site Scripting (XSS) vulnerability

    Cross-site scripting (XSS) vulnerability in flashuploader.swf in the Uploader component in Yahoo! YUI 3.5.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, a…

    moodle/moodle yui npm Packagist
  • Medium —
    CVE-2011-4969 EPSS 19%

    jQuery vulnerable to Cross-Site Scripting (XSS)

    Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.

    jquery-rails org.webjars.npm:jquery jQuery jquery Azure Linux npm Maven NuGet RubyGems
  • Medium —
    CVE-2012-5881

    Cross-site scripting in yui 2.4.0

    Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.4.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to charts.swf, a similar issue to CVE-2010-4207.

    yui2 npm
  • Medium —
    CVE-2011-1714 Public exploit

    QooxDoo XSS in Callback Parameter

    Cross-site scripting (XSS) vulnerability in framework/source/resource/qx/test/jsonp_primitive.php in QooxDoo 1.3 and possibly other versions, as used in eyeOS 2.2 and 2.3, and possibly other products allows remote attackers to inject arbitrary web script or H…

    qooxdoo npm
  • Medium —
    CVE-2010-2273 Public exploit

    Cross-Site Scripting in dojo

    Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly …

    dojo dojo Debian npm
  • Medium —
    CVE-2008-6681

    Cross-Site Scripting in dojo

    Cross-site scripting (XSS) vulnerability in dijit.Editor in Dojo before 1.1 allows remote attackers to inject arbitrary web script or HTML via XML entities in a TEXTAREA element.

    dojo npm