npm
4,292 tracked vulnerabilities.
CVE-2020-5251
HIGH
parse-server < 4.1.0 - Improper Authorization via NoSQL Query Regex
Mar 04, 2020
CVSS 7.7
EPSS 0.01
CVE-2020-8132
CRITICAL
pdf-image <= 2.0.0 - Remote Code Execution via Untrusted PDF File Path
Feb 28, 2020
CVSS 9.8
EPSS 0.02
CVE-2020-8127
MEDIUM
reveal.js < 3.9.1 - Cross-Site Scripting via postMessage
Feb 28, 2020
CVSS 6.1
EPSS 0.01
CVE-2020-8131
HIGH
Yarn < 1.22.0 - Arbitrary Filesystem Write via Malicious Package Installation
Feb 24, 2020
CVSS 7.5
EPSS 0.05
CVE-2020-5243
MEDIUM
uap-core < 0.7.3 - Denial of Service via User-Agent Regex Processing
Feb 21, 2020
CVSS 5.7
EPSS 0.02
CVE-2020-7597
HIGH
codecov-node < 3.6.5 - Remote Code Execution via gcov-root Argument
Feb 17, 2020
CVSS 8.8
EPSS 0.03
CVE-2020-9038
MEDIUM
Joplin < 1.0.184 - Stored Cross-Site Scripting and Arbitrary File Read
Feb 17, 2020
CVSS 5.4
EPSS 0.04
CVE-2020-8129
CRITICAL
script-manager < 0.8.6 - Remote Code Execution via Unintended Require
Feb 14, 2020
CVSS 9.8
EPSS 0.03
CVE-2020-8128
CRITICAL
jsreport < 2.5.0 - Server-Side Request Forgery and Arbitrary Code Execution
Feb 14, 2020
CVSS 9.8
EPSS 0.03
CVE-2020-8823
MEDIUM
SockJS < 0.3.0 - Reflected Cross-Site Scripting via HTMLFile Callback Parameter
Feb 10, 2020
CVSS 6.1
EPSS 0.02
CVE-2020-8125
CRITICAL
klona < 1.1.0 - Prototype Pollution via Input Validation Flaw
Feb 04, 2020
CVSS 9.8
EPSS 0.04
CVE-2020-8124
MEDIUM
url-parse < 1.4.4 - Security Check Bypass via Insufficient Input Validation
Feb 04, 2020
CVSS 5.3
EPSS 0.02
CVE-2020-8123
MEDIUM
Strapi < 3.0.0-beta.18.3 - Authenticated Denial of Service via Admin Console
Feb 04, 2020
CVSS 4.9
EPSS 0.01
CVE-2020-8116
HIGH
dot-prop <4.2.1, <5.1.1 - Prototype Pollution
Feb 04, 2020
CVSS 7.3
EPSS 0.03
CVE-2020-7596
HIGH
Codecov nodejs_uploader < 3.6.2 - Remote Code Execution via gcov-args Argument
Jan 25, 2020
CVSS 8.8
EPSS 0.02
CVE-2020-5219
HIGH
peerigon angular-expressions < 1.0.1 - Remote Code Execution via Expression Compilation
Jan 24, 2020
CVSS 8.7
EPSS 0.02
CVE-2020-6948
CRITICAL
HashBrown CMS < 1.3.3 - Remote Code Execution via GitDeployer URL Parameter
Jan 13, 2020
CVSS 9.8
EPSS 0.04
CVE-2020-6836
CRITICAL
hot-formula-parser < 3.0.1 - Remote Code Execution via Unsanitized Formula Input
Jan 11, 2020
CVSS 9.8
EPSS 0.02
CVE-2020-5840
HIGH
HashBrown CMS <1.3.2 - Path Traversal
Jan 06, 2020
CVSS 7.5
EPSS 0.01
CVE-2019-25225
MEDIUM
sanitize-html < 2.0.0-beta - Cross-Site Scripting via transformTags Option
Sep 08, 2025
CVSS 6.1
EPSS 0.00
CVE-2019-25158
MEDIUM
pedroetb tts-api <2.1.4 - Code Injection
Dec 19, 2023
CVSS 5.5
EPSS 0.02
CVE-2019-25155
MEDIUM
DOMPurify < 1.0.11 - Reverse Tabnabbing via Demo Page Links
Nov 07, 2023
CVSS 6.1
EPSS 0.01
CVE-2019-25103
MEDIUM
simple-markdown <0.5.2 - Info Disclosure
Feb 12, 2023
CVSS 4.3
EPSS 0.01
CVE-2019-25102
MEDIUM
simple-markdown <0.6.1 - Inefficient Regular Expression Complexity
Feb 12, 2023
CVSS 4.3
EPSS 0.01
CVE-2019-10761
HIGH
vm2 <3.6.11 - Code Injection
Jul 13, 2022
CVSS 8.3
EPSS 0.01
Products
openclaw 433
parse-server 98
n8n 87
flowise 67
directus 55
nocodb 54
electron 49
next 47
vm2 41
hono 38
axios 33
undici 30
pnpm 25
ghost 22
vite 21
astro 19
tar 19
tinymce 18
protobufjs 16
ckeditor4 15
fuxa-server 15
jspdf 15
joplin 14
liquidjs 14
nodebb 14
sequelize 14
angular 13
flowise-components 13
react-router 13
signalk-server 13
Quick Filters