npm
4,315 tracked vulnerabilities.
CVE-2017-18077
HIGH
brace-expansion < 1.1.7 - Regular Expression Denial of Service via Comma Character Input
Jan 27, 2018
CVSS 7.5
EPSS 0.03
CVE-2017-1000491
MEDIUM
Shiba markdown live preview app <1.1.0 - XSS
Jan 03, 2018
CVSS 6.1
EPSS 0.01
CVE-2017-1000427
MEDIUM
marked < 0.3.6 - Cross-Site Scripting via data: URI Parser
Jan 02, 2018
CVSS 6.1
EPSS 0.02
CVE-2017-1000424
MEDIUM
Github Electron <1.6.11, <1.7.5 - Open Redirect
Jan 02, 2018
CVSS 4.3
EPSS 0.01
CVE-2017-1000452
HIGH
Samlify < 2.2.0 - XML Signature Wrapping
Jan 02, 2018
CVSS 7.5
EPSS 0.01
CVE-2017-1000451
HIGH
fs-git < 1.0.1 - Command Injection via buildCommand Method
Jan 02, 2018
CVSS 7.8
EPSS 0.01
CVE-2017-10910
MEDIUM
MQTT.js 2.x.x < 2.15.0 - Denial of Service via PUBLISH Ticket Handling
Dec 28, 2017
CVSS 6.5
EPSS 0.02
CVE-2017-16897
HIGH
Auth0 passport-wsfed-saml2 <3.0.5 - Privilege Escalation
Dec 27, 2017
CVSS 8.1
EPSS 0.01
CVE-2017-17068
HIGH
auth0.js < 8.12 - Unauthenticated Exposure of Sensitive Information via Popup Callback
Dec 06, 2017
CVSS 7.5
EPSS 0.01
CVE-2017-1001004
HIGH
typed-function < 0.10.6 - Remote Code Execution via Typed Function Name
Nov 27, 2017
CVSS 8.8
EPSS 0.02
CVE-2017-1001003
CRITICAL
mathjs < 3.17.0 - Prototype Pollution via Unicode Character Bypass
Nov 27, 2017
CVSS 9.8
EPSS 0.02
CVE-2017-1001002
CRITICAL
math.js < 3.17.0 - Remote Code Execution via Typed Function Name Injection
Nov 27, 2017
CVSS 9.8
EPSS 0.02
CVE-2017-1000170
HIGH
NUCLEI
jqueryFileTree <2.1.5 - Path Traversal
Nov 17, 2017
CVSS 7.5
EPSS 0.59
CVE-2017-16877
HIGH
NUCLEI
Nextjs <2.4.1 - Local File Inclusion
Nov 17, 2017
CVSS 7.5
EPSS 0.14
CVE-2017-1000228
CRITICAL
ejs < 2.5.3 - Remote Code Execution via Weak Input Validation in ejs.renderFile()
Nov 17, 2017
CVSS 9.8
EPSS 0.06
CVE-2017-1000189
HIGH
ejs < 2.5.5 - Denial of Service via Weak Input Validation in ejs.renderFile()
Nov 17, 2017
CVSS 7.5
EPSS 0.02
CVE-2017-1000188
MEDIUM
ejs < 2.5.5 - Cross-Site Scripting via ejs.renderFile()
Nov 17, 2017
CVSS 6.1
EPSS 0.01
CVE-2017-1000220
CRITICAL
soyuka/pidusage <=1.1.4 - Command Injection
Nov 17, 2017
CVSS 9.8
EPSS 0.05
CVE-2017-1000219
CRITICAL
npm/KyleRoss windows-cpu - Command Injection
Nov 17, 2017
CVSS 9.8
EPSS 0.04
CVE-2017-16782
MEDIUM
Home Assistant < 0.57 - Stored Cross-Site Scripting via Persistent Notification Markdown
Nov 10, 2017
CVSS 6.1
EPSS 0.01
CVE-2017-16570
HIGH
KeystoneJS < 4.0.0-beta.7 - Cross-Site Request Forgery via Missing x-csrf-token Header
Nov 06, 2017
CVSS 8.8
EPSS 0.02
CVE-2017-15881
MEDIUM
KeystoneJS < 4.0.0-beta.7 - Authenticated Stored Cross-Site Scripting via Content Fields
Oct 24, 2017
CVSS 4.8
EPSS 0.01
CVE-2017-15879
HIGH
KeystoneJS < 4.0.0-beta.7 - CSV Injection via CSV Export
Oct 24, 2017
CVSS 8.8
EPSS 0.07
CVE-2017-15878
MEDIUM
KeystoneJS < 4.0.0 - Stored Cross-Site Scripting via Contact Us Feature
Oct 24, 2017
CVSS 6.1
EPSS 0.03
CVE-2017-15010
HIGH
tough-cookie < 2.3.3 - Uncontrolled Resource Consumption via ReDoS
Oct 04, 2017
CVSS 7.5
EPSS 0.03
Products
openclaw 433
n8n 110
parse-server 98
flowise 67
directus 55
nocodb 54
electron 49
next 47
vm2 41
hono 38
axios 33
undici 30
pnpm 25
ghost 22
vite 21
astro 19
tar 19
tinymce 18
protobufjs 16
ckeditor4 15
fuxa-server 15
jspdf 15
joplin 14
liquidjs 14
nodebb 14
sequelize 14
angular 13
flowise-components 13
react-router 13
signalk-server 13
Quick Filters