npm

4,292 tracked vulnerabilities.

CVE-2019-18608 HIGH
Cezerin 0.33.0 - Unauthenticated Order Information Modification via PUT /ajax/cart
Oct 29, 2019
CVSS 7.5
EPSS 0.01
CVE-2019-10749 CRITICAL
sequelize < 3.35.1 - SQL Injection via Postgres JSON Path Keys
Oct 29, 2019
CVSS 9.8
EPSS 0.01
CVE-2019-10748 CRITICAL
Sequelize < 3.35.1, 4.44.3, 5.8.11 - SQL Injection via MySQL/MariaDB JSON Path Keys
Oct 29, 2019
CVSS 9.8
EPSS 0.01
CVE-2019-18413 LOW
class-validator < 0.14.0 - Input Validation Bypass and Cross-Site Scripting via Conflicting Attribute Names
Oct 24, 2019
CVSS 3.7
EPSS 0.02
CVE-2019-17606 MEDIUM
hexo-admin < 2.3.0 - Stored Cross-Site Scripting in Post Editor
Oct 23, 2019
CVSS 6.1
EPSS 0.01
CVE-2019-10752 CRITICAL
Sequelize < 4.44.3 - SQL Injection via sequelize.json() Helper Function
Oct 17, 2019
CVSS 9.8
EPSS 0.01
CVE-2019-17625 CRITICAL
Rambox 0.6.9 - Stored Cross-Site Scripting and OS Command Injection via Service Name Field
Oct 16, 2019
CVSS 9.0
EPSS 0.03
CVE-2019-10760 CRITICAL
safer-eval < 1.3.2 - Arbitrary Code Execution via Constructor Properties
Oct 15, 2019
CVSS 9.9
EPSS 0.03
CVE-2019-10759 CRITICAL
safer-eval < 1.3.4 - Arbitrary Code Execution via Constructor Properties
Oct 15, 2019
CVSS 9.9
EPSS 0.02
CVE-2019-17592 HIGH
csv-parse < 4.4.6 - Regular Expression Denial of Service via __isInt Function
Oct 14, 2019
CVSS 7.5
EPSS 0.02
CVE-2019-17495 CRITICAL
Swagger UI < 3.23.11 - CSS Injection via Relative Path Overwrite
Oct 10, 2019
CVSS 9.8
EPSS 0.06
CVE-2019-17426 CRITICAL
Automattic Mongoose <5.7.4 - Auth Bypass
Oct 10, 2019
CVSS 9.1
EPSS 0.02
CVE-2019-10757 CRITICAL
knex < 0.19.5 - SQL Injection via MSSQL Dialect Identifier Escaping
Oct 08, 2019
CVSS 9.8
EPSS 0.01
CVE-2019-10756 MEDIUM
node-red-dashboard < 2.17.0 - Cross-Site Scripting via UI Notification Node
Oct 08, 2019
CVSS 5.4
EPSS 0.01
CVE-2019-16728 MEDIUM
DOMPurify < 2.0.1 - Cross-Site Scripting via mXSS in SVG/MATH Elements
Sep 24, 2019
CVSS 6.1
EPSS 0.02
CVE-2019-15138 HIGH
html-pdf < 3.0.1 - Arbitrary File Read via XMLHttpRequest
Sep 20, 2019
CVSS 7.5
EPSS 0.02
CVE-2019-16303 CRITICAL
JHipster <6.3.0 & JHipster Kotlin <=1.1.0 - Privilege Escalation
Sep 14, 2019
CVSS 9.8
EPSS 0.04
CVE-2019-5485 CRITICAL
gitlabhook 0.0.17 - OS Command Injection via Repository Name
Sep 13, 2019
CVSS 10.0
EPSS 0.60
CVE-2019-5484 HIGH
bower < 1.8.8 - Path Traversal and Arbitrary File Write via Install Command
Sep 13, 2019
CVSS 7.5
EPSS 0.03
CVE-2019-5483 MEDIUM
Seneca < 3.9.0 - Unauthorized Exposure of Environment Variables
Sep 09, 2019
CVSS 5.3
EPSS 0.01
CVE-2019-15954 CRITICAL
Total.js CMS 12.0.0 - Authenticated RCE
Sep 05, 2019
CVSS 9.9
EPSS 0.79
CVE-2019-15953 HIGH
Total.js CMS 12.0.0 - Privilege Escalation
Sep 05, 2019
CVSS 8.8
EPSS 0.02
CVE-2019-15952 HIGH
Total.js CMS 12.0.0 - Path Traversal
Sep 05, 2019
CVSS 8.8
EPSS 0.05
CVE-2019-5480 MEDIUM
statichttpserver <= 0.9.7 - Path Traversal
Sep 03, 2019
CVSS 5.3
EPSS 0.02
CVE-2019-5479 HIGH
larvitbase-api < v0.5.5 - Info Disclosure
Sep 03, 2019
CVSS 7.5
EPSS 0.01
Products
openclaw 433 parse-server 98 n8n 87 flowise 67 directus 55 nocodb 54 electron 49 next 47 vm2 41 hono 38 axios 33 undici 30 pnpm 25 ghost 22 vite 21 astro 19 tar 19 tinymce 18 protobufjs 16 ckeditor4 15 fuxa-server 15 jspdf 15 joplin 14 liquidjs 14 nodebb 14 sequelize 14 angular 13 flowise-components 13 react-router 13 signalk-server 13
Quick Filters
Critical CVEs With Exploits In CISA KEV