npm
4,292 tracked vulnerabilities.
CVE-2020-7620
CRITICAL
pomelo-monitor <= 0.3.7 - OS Command Injection via ProcessMonitor Params
Apr 02, 2020
CVSS 9.8
EPSS 0.02
CVE-2020-7619
CRITICAL
get-git-data < 1.3.1 - OS Command Injection via Argument Injection
Apr 02, 2020
CVSS 9.8
EPSS 0.02
CVE-2020-7617
MEDIUM
ini-parser <= 0.0.2 - Prototype Pollution via __proto__ Payload
Apr 02, 2020
CVSS 4.4
EPSS 0.01
CVE-2020-5284
MEDIUM
NUCLEI
Next.js < 9.3.2 - Path Traversal in Dist Directory
Mar 30, 2020
CVSS 4.4
EPSS 0.43
CVE-2020-7610
CRITICAL
mongodb/bson < 1.1.4 - Deserialization of Untrusted Data via _bsotype Handling
Mar 30, 2020
CVSS 9.8
EPSS 0.02
CVE-2020-8910
MEDIUM
Google Closure Library <v20200315 - SSRF
Mar 26, 2020
CVSS 6.5
EPSS 0.01
CVE-2020-10800
HIGH
lix < 15.8.7 - Remote Code Execution via Man-in-the-Middle Location Header Injection
Mar 21, 2020
CVSS 8.1
EPSS 0.01
CVE-2020-8137
CRITICAL
blamer < 1.0.1 - Remote Code Execution via Code Injection
Mar 20, 2020
CVSS 9.8
EPSS 0.04
CVE-2020-8136
HIGH
fastify-multipart < 1.0.5 - Memory Corruption
Mar 20, 2020
CVSS 7.5
EPSS 0.01
CVE-2020-8134
HIGH
Ghost CMS < 3.10.0 - Server-Side Request Forgery
Mar 20, 2020
CVSS 8.1
EPSS 0.01
CVE-2020-7608
MEDIUM
yargs-parser < 5.0.1 and 6.0.0-13.1.2 - Prototype Pollution via __proto__ Payload
Mar 16, 2020
CVSS 5.3
EPSS 0.01
CVE-2020-7607
CRITICAL
gulp-styledocco < 0.0.3 - OS Command Injection via Options Argument
Mar 15, 2020
CVSS 9.8
EPSS 0.03
CVE-2020-7606
CRITICAL
docker-compose-remote-api <= 0.1.4 - OS Command Injection via Service Name Parameter
Mar 15, 2020
CVSS 9.8
EPSS 0.03
CVE-2020-7605
CRITICAL
gulp-tape < 1.0.0 - OS Command Injection via Options Parameter
Mar 15, 2020
CVSS 9.8
EPSS 0.03
CVE-2020-7604
CRITICAL
pulverizr < 0.7.0 - OS Command Injection via Unsanitized Filename in lib/job.js
Mar 15, 2020
CVSS 9.8
EPSS 0.03
CVE-2020-7603
CRITICAL
closure-compiler-stream < 0.1.15 - OS Command Injection via Unsanitized Options Argument
Mar 15, 2020
CVSS 9.8
EPSS 0.03
CVE-2020-7602
CRITICAL
node-prompt-here <= 1.0.1 - OS Command Injection via getDevices Function
Mar 15, 2020
CVSS 9.8
EPSS 0.03
CVE-2020-7601
CRITICAL
gulp-scss-lint < 1.0.0 - OS Command Injection via Options Parameter
Mar 15, 2020
CVSS 9.8
EPSS 0.03
CVE-2020-8141
HIGH
dot package <1.1.2 - Code Injection
Mar 15, 2020
CVSS 8.8
EPSS 0.02
CVE-2020-10544
MEDIUM
PrimeFaces < 8.0 - Stored Cross-Site Scripting in Tooltip Title
Mar 13, 2020
CVSS 6.1
EPSS 0.01
CVE-2020-7600
MEDIUM
querymen < 2.1.4 - Prototype Pollution via Unsanitized Handler Parameters
Mar 12, 2020
CVSS 5.3
EPSS 0.01
CVE-2020-7598
MEDIUM
minimist < 1.2.2 - Prototype Pollution via Constructor or __proto__ Payload
Mar 11, 2020
CVSS 5.6
EPSS 0.02
CVE-2020-5259
HIGH
dojox < 1.11.10 - Prototype Pollution via jqMix Method
Mar 10, 2020
CVSS 7.7
EPSS 0.02
CVE-2020-5258
HIGH
dojo < 1.11.10 - Prototype Pollution via deepCopy Method
Mar 10, 2020
CVSS 7.7
EPSS 0.04
CVE-2020-9281
MEDIUM
CKEditor 4.0-4.13 - Cross-Site Scripting via Protected Comment Injection
Mar 07, 2020
CVSS 6.1
EPSS 0.04
Products
openclaw 433
parse-server 98
n8n 87
flowise 67
directus 55
nocodb 54
electron 49
next 47
vm2 41
hono 38
axios 33
undici 30
pnpm 25
ghost 22
vite 21
astro 19
tar 19
tinymce 18
protobufjs 16
ckeditor4 15
fuxa-server 15
jspdf 15
joplin 14
liquidjs 14
nodebb 14
sequelize 14
angular 13
flowise-components 13
react-router 13
signalk-server 13
Quick Filters