Tagged “npm”

CVEs tagged npm, newest first.

1554 CVEsRSS

CVE-2026-113800Medium· 5.4

Electron: HID and USB permission checks can be attributed to the wrong origin

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, hid and usb permission checks made from an iframe caused setPermission…

▾ Sunlitelectron · electronEPSS 0.24%via CVEORG

CVE-2026-113711High· 7.5PoC

6d ago

ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export

▾ Midnightapostrophe · apostropheEPSS 0.56%via GHSA

CVE-2026-112957Medium· 4.3

6d ago

ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users

▾ Sunlitapostrophe · apostropheEPSS 0.31%via GHSA

CVE-2026-113650Medium· 5.3

6d ago

ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)

▾ Sunlitsanitize-html · sanitize-htmlEPSS 0.40%via GHSA

CVE-2026-112958Medium· 5.4PoC

6d ago

ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization

▾ Twilightapostrophe · apostropheEPSS 0.30%via GHSA

CVE-2026-112945Low· 2.1

6d ago

Vite: Cross origin script execution through Vite custom middleware

▾ Sunlitvite · viteEPSS 0.56%via GHSA

CVE-2026-112946Medium· 6.3PoC

6d ago

Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

▾ Twilightvite · viteEPSS 0.85%via GHSA

CVE-2026-112947Medium· 6.3

6d ago

Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

▾ Sunlitvite · viteEPSS 0.50%via GHSA

CVE-2026-112948Medium· 6.5

6d ago

Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file

▾ Sunlitvitest · @vitest/uiEPSS 0.40%via GHSA

CVE-2026-112950Medium· 5.9

6d ago

Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix

▾ Sunlitvitest · @vitest/mockerEPSS 0.46%via GHSA

CVE-2026-112951Medium· 5.4PoC

6d ago

ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix

▾ Twilightapostrophe · apostropheEPSS 0.30%via GHSA

CVE-2026-112953Medium· 6.0PoC

6d ago

ApostropheCMS: Exposure of Sensitive Information via predictable export filenames

▾ Twilightapostrophecms · @apostrophecms/import-exportEPSS 0.56%via GHSA

CVE-2026-112952Medium· 4.3

6d ago

ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user

▾ Sunlitapostrophe · apostropheEPSS 0.33%via GHSA

CVE-2026-112956Medium· 6.5

6d ago

ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content

▾ Sunlitapostrophecms · @apostrophecms/import-exportEPSS 0.34%via GHSA

CVE-2026-111758High· 7.5

1w ago

markdown-it: markdown-it: Denial of Service via unclosed link reference definitions (CVE-2026-111758)

A flaw was found in markdown-it. A remote attacker can cause a Denial of Service (DoS) by providing specially crafted Markdown input that contains an unclosed link reference definition spanning multiple lines. Processing this input trigger…

▾ TwilightRed Hat · Red Hat Developer HubEPSS 0.46%via CSAF

CVE-2026-111753Medium

1w ago

@angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)

▾ Sunlitangular · @angular/commonvia GHSA

CVE-2026-111771Medium· 6.8

1w ago

MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service

▾ Sunlitmodelcontextprotocol · @modelcontextprotocol/sdkvia GHSA

CVE-2026-111770High· 7.7PoC

1w ago

MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another

▾ Midnightmodelcontextprotocol · @modelcontextprotocol/servervia GHSA

CVE-2026-111768High· 7.5

1w ago

MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation

▾ Twilightmodelcontextprotocol · @modelcontextprotocol/sdkvia GHSA

CVE-2026-111769Medium· 6.5

1w ago

MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies

▾ Sunlitmodelcontextprotocol · @modelcontextprotocol/sdkvia GHSA

CVE-2026-111767High· 8.6

1w ago

@modelcontextprotocol/sdk: @modelcontextprotocol/sdk: Unauthorized cross-session task access via taskStore (CVE-2026-111767)

A flaw was found in the Model Context Protocol (MCP) TypeScript SDK (@modelcontextprotocol/sdk). The experimental task storage feature (taskStore) does not verify which client session created a given task when multiple clients share a task…

▾ TwilightRed Hat · Red Hat Enterprise Linux 10EPSS 0.34%via CSAF

CVE-2026-113659Medium· 6.1

1w ago

ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users

▾ Sunlitapostrophe · apostropheEPSS 0.34%via GHSA

CVE-2026-113664Medium· 5.3PoC

1w ago

ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal …

▾ Twilightapostrophecms · apostropheEPSS 0.48%via CVEORG

CVE-2026-113662Medium· 5.4

1w ago

ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated user with import access to a target type can supply an object or operator as an update-key value, causing the…

▾ Sunlitapostrophecms · apostropheEPSS 0.30%via CVEORG

CVE-2026-113661Medium· 5.4

1w ago

ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default configuration that allows meta refresh elements and thei…

▾ Sunlitapostrophecms · apostropheEPSS 0.26%via CVEORG

CVE-2026-113665Low· 3.7

1w ago

ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints

▾ Sunlitapostrophe · apostropheEPSS 0.28%via GHSA

CVE-2026-113668Medium· 5.3

1w ago

ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1/<piece-type>/:_id/locales (and the equivalent page route) does not apply the publicApiCheckAsync gate that ApostropheCMS's oth…

▾ Sunlitapostrophecms · apostropheEPSS 0.32%via CVEORG

CVE-2026-113710Medium· 5.9

1w ago

ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or l…

▾ Sunlitapostrophecms · apostropheEPSS 0.33%via CVEORG

CVE-2026-113660Medium· 4.3PoC

1w ago

ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers

▾ Twilightapostrophe · apostropheEPSS 0.36%via GHSA

CVE-2026-111751High

1w ago

@angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)

▾ Twilightangular · @angular/routervia GHSA