Tagged “npm”
CVEs tagged npm, newest first.
1673 CVEsRSS
CVE-2026-54307High· 9.6n8n: Credential Exfiltration via Permission Bypass
n8n: Credential Exfiltration via Permission Bypass
CVE-2026-54305High· 9.9n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints
n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints
CVE-2026-54309High· 10.0n8n: MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions
n8n: MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions
CVE-2026-54304High· 7.7n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host
n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host
GHSA-m3q2-p4fw-w38mLowCross-site scripting via <NoScript> slot content in Nuxt's head components
Cross-site scripting via <NoScript> slot content in Nuxt's head components
CVE-2026-49993Medium@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)
@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)
CVE-2026-54326Low· 2.5Pi Agent: Potential XSS in HTML session exports via Markdown URL sanitization bypass
Pi Agent: Potential XSS in HTML session exports via Markdown URL sanitization bypass
CVE-2026-12208Medium· 5.3jsonata: Function Binding Prototype Pollution via hasOwnProperty Override
jsonata: Function Binding Prototype Pollution via hasOwnProperty Override
CVE-2026-54267HighAngular Client Hydration DOM Clobbering & Response-Cache Poisoning
Angular Client Hydration DOM Clobbering & Response-Cache Poisoning
CVE-2026-49982High· 8.2tmp: Type-confusion bypass of _assertPath allows path traversal via non-string prefix/postfix/template
tmp: Type-confusion bypass of _assertPath allows path traversal via non-string prefix/postfix/template
CVE-2026-50168High@angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass
@angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass
CVE-2026-50169MediumAngular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities
Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities
CVE-2026-52725Medium@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)
@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)
CVE-2026-50170High@angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache
@angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache
CVE-2026-50171High@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)
@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)
CVE-2026-50184Medium@angular/service-worker: Request Credential & Cache Policy Stripping
@angular/service-worker: Request Credential & Cache Policy Stripping
CVE-2026-49356Low· 3.2@babel/core: Arbitrary File Read via sourceMappingURL Comment
@babel/core: Arbitrary File Read via sourceMappingURL Comment
CVE-2026-53571MediumPoCvite: `server.fs.deny` bypass on Windows alternate paths
vite: `server.fs.deny` bypass on Windows alternate paths
CVE-2026-53632Mediumlaunch-editor: NTLMv2 hash disclosure via UNC path handling on Windows
launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows
CVE-2026-50555High@angular/platform-server: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
@angular/platform-server: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-50557MediumAngular: Template and Attribute Namespace Sanitization Bypass (XSS)
Angular: Template and Attribute Namespace Sanitization Bypass (XSS)
CVE-2026-54265Medium@angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS)
@angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS)
CVE-2026-54266High@angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning
@angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning
CVE-2026-54268High@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)
@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)
CVE-2026-54264High@angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker
@angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker
CVE-2026-54269Medium· 5.3protobufjs : Schema-derived names can shadow runtime-significant properties
protobufjs : Schema-derived names can shadow runtime-significant properties
GHSA-r7g4-qg5f-qqm2Medium· 6.5Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception
Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception
GHSA-wqvq-jvpq-h66fMedium· 5.4Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization
Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization
GHSA-268h-hp4c-crq3Medium· 5.4Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection
Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection
CVE-2026-49459Medium· 6.1DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM
DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM