npm
4,292 tracked vulnerabilities.
CVE-2018-16459
MEDIUM
exceljs < 1.6 - Cross-Site Scripting via Cell Value
Sep 06, 2018
CVSS 6.1
EPSS 0.01
CVE-2018-16330
MEDIUM
Pandao Editor.md 1.5.0 - Cross-Site Scripting via Invalid IMG Element Attributes
Sep 02, 2018
CVSS 6.1
EPSS 0.01
CVE-2018-3787
HIGH
simplehttpserver < 0.2.1 - Path Traversal
Aug 31, 2018
CVSS 7.5
EPSS 0.02
CVE-2018-11615
HIGH
npm mosca < 2.8.2 - Unauthenticated Denial of Service via Crafted Topic Regular Expression
Aug 30, 2018
CVSS 7.5
EPSS 0.03
CVE-2018-3786
CRITICAL
egg-scripts < 2.8.1 - OS Command Injection via Command Line Argument
Aug 24, 2018
CVSS 9.8
EPSS 0.12
CVE-2018-15685
HIGH
Electron 1.7.15, 1.8.7, 2.0.7, 3.0.0-beta.6 - Remote Code Execution via WebPreferences Misconfiguration
Aug 23, 2018
CVSS 8.1
EPSS 0.10
CVE-2018-15494
CRITICAL
Dojo Toolkit <1.14 - Code Injection
Aug 18, 2018
CVSS 9.8
EPSS 0.03
CVE-2018-3785
CRITICAL
git-dummy-commit v1.3.0 - OS Command Injection via Unescaped Parameter
Aug 17, 2018
CVSS 9.8
EPSS 0.04
CVE-2018-3784
CRITICAL
cryo 0.0.6 - Remote Code Execution via Insecure Deserialization
Aug 17, 2018
CVSS 9.8
EPSS 0.03
CVE-2018-3783
CRITICAL
flintcms <= 1.1.9 - Blind MongoDB Injection in Password Reset
Aug 17, 2018
CVSS 9.8
EPSS 0.04
CVE-2018-3774
CRITICAL
url-parse < 1.4.3 - Server-Side Request Forgery via Incorrect Hostname Parsing
Aug 12, 2018
CVSS 10.0
EPSS 0.04
CVE-2018-3778
MEDIUM
aedes < 0.35.0 - Improper Authorization
Aug 08, 2018
CVSS 5.3
EPSS 0.01
CVE-2018-3773
MEDIUM
metascraper <= 3.9.2 - Stored Cross-Site Scripting in Open Graph Meta Properties
Jul 30, 2018
CVSS 6.1
EPSS 0.01
CVE-2018-3772
CRITICAL
whereis < 0.4.1 - OS Command Injection via Unsanitized Input Concatenation
Jul 30, 2018
CVSS 9.8
EPSS 0.03
CVE-2018-1002204
MEDIUM
adm-zip < 0.4.9 - Path Traversal via Zip Archive Entry Extraction
Jul 25, 2018
CVSS 5.5
EPSS 0.15
CVE-2018-1002203
MEDIUM
unzipper < 0.8.13 - Path Traversal via Zip Archive Entry
Jul 25, 2018
CVSS 5.5
EPSS 0.12
CVE-2018-1999024
MEDIUM
MathJax < 2.7.4 - Cross-Site Scripting via Unicode Macro
Jul 23, 2018
CVSS 5.4
EPSS 0.01
CVE-2018-3771
MEDIUM
statics-server <= 0.0.9 - Cross-Site Scripting via Directory Index Filename
Jul 20, 2018
CVSS 6.1
EPSS 0.01
CVE-2018-3770
MEDIUM
markdown-pdf < 9.0.0 - Path Traversal via Malicious HTML Code
Jul 20, 2018
CVSS 5.5
EPSS 0.01
CVE-2018-14042
MEDIUM
Bootstrap < 4.1.2 - Cross-Site Scripting via Tooltip Data-Container Property
Jul 13, 2018
CVSS 6.1
EPSS 0.04
CVE-2018-14041
MEDIUM
Bootstrap 4.0.0-4.1.1 - Cross-Site Scripting via Scrollspy Data-Target Property
Jul 13, 2018
CVSS 6.1
EPSS 0.04
CVE-2018-14040
MEDIUM
Bootstrap <4.1.2 - XSS
Jul 13, 2018
CVSS 6.1
EPSS 0.04
CVE-2018-8319
CRITICAL
Microsoft Research JavaScript Cryptography Library - Info Disclosure
Jul 11, 2018
CVSS 9.8
EPSS 0.07
CVE-2018-13863
HIGH
mongodb/js-bson 0.5.0-1.0.4 - Regular Expression Denial of Service in Decimal128.fromString()
Jul 10, 2018
CVSS 7.5
EPSS 0.02
CVE-2018-13797
CRITICAL
node-macaddress < 0.2.9 - OS Command Injection via Unsanitized Input to exec Call
Jul 10, 2018
CVSS 9.8
EPSS 0.07
Products
openclaw 433
parse-server 98
n8n 87
flowise 67
directus 55
nocodb 54
electron 49
next 47
vm2 41
hono 38
axios 33
undici 30
pnpm 25
ghost 22
vite 21
astro 19
tar 19
tinymce 18
protobufjs 16
ckeditor4 15
fuxa-server 15
jspdf 15
joplin 14
liquidjs 14
nodebb 14
sequelize 14
angular 13
flowise-components 13
react-router 13
signalk-server 13
Quick Filters