Tagged “npm”
CVEs tagged npm, newest first.
1673 CVEsRSS
CVE-2025-64495High· 8.7PoCOpen WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE
Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE
CVE-2025-64496High· 7.3Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events
Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events
CVE-2025-11849Critical· 9.3Mammoth is vulnerable to Directory Traversal
Mammoth is vulnerable to Directory Traversal
CVE-2025-11183MediumCross-Site Scripting vulnerability in attribute table in QGIS QWC2 <2025.08.14 allows an authorized attacker to plant arbitrary JavaScript code in the page
Cross-Site Scripting vulnerability in attribute table in QGIS QWC2 <2025.08.14 allows an authorized attacker to plant arbitrary JavaScript code in the page
CVE-2025-1647Medium· 5.6PoCImproper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bootstrap allows Cross-Site Scripting (XSS).This issue affects Bootstrap: from 3.4.1 before 4.0.0.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bootstrap allows Cross-Site Scripting (XSS).This issue affects Bootstrap: from 3.4.1 before 4.0.0.
CVE-2025-32388Medium· 5.4@sveltejs/kit vulnerable to Cross-site Scripting via tracked search_params
@sveltejs/kit vulnerable to Cross-site Scripting via tracked search_params
CVE-2024-11831Medium· 5.4A flaw was found in npm-serialize-javascript
A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject mali…
CVE-2024-53262Low· 4.2@sveltejs/kit has unescaped error message included on error page
@sveltejs/kit has unescaped error message included on error page
CVE-2024-39896High· 7.5Directus Allows Single Sign-On User Enumeration
Directus Allows Single Sign-On User Enumeration
CVE-2024-38355Medium· 7.3PoCsocket.io has an unhandled 'error' event
socket.io has an unhandled 'error' event
CVE-2024-38357Medium· 6.1TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements
TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements
CVE-2024-38356Medium· 6.1TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option
TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option
CVE-2024-21485Medium· 6.5PoCDash apps vulnerable to Cross-site Scripting
Dash apps vulnerable to Cross-site Scripting
CVE-2024-23641High· 7.5Sending a GET or HEAD request with a body crashes SvelteKit
Sending a GET or HEAD request with a body crashes SvelteKit
CVE-2024-21910Medium· 6.1Cross-site scripting vulnerability in TinyMCE plugins
TinyMCE versions before 5.10.0 are affected by a cross-site scripting vulnerability. A remote and unauthenticated attacker could introduce crafted image or link URLs that would result in the execution of arbitrary JavaScript in an editin…
CVE-2023-26154Medium· 5.9pubnub Insufficient Entropy vulnerability
pubnub Insufficient Entropy vulnerability
CVE-2023-48238High· 7.5json-web-token library is vulnerable to a JWT algorithm confusion attack
json-web-token library is vulnerable to a JWT algorithm confusion attack
CVE-2023-29008High· 8.8SvelteKit framework has Insufficient CSRF protection for CORS requests
SvelteKit framework has Insufficient CSRF protection for CORS requests
CVE-2023-29003High· 8.8SvelteKit vulnerable to Cross-Site Request Forgery
SvelteKit vulnerable to Cross-Site Request Forgery
GHSA-593v-wcqx-hq2wHigh· 7.5Incorrect version tags linked to external repository
Incorrect version tags linked to external repository
CVE-2021-32822Medium· 4.0hbs: Insertion of Sensitive Information into Externally-Accessible File or Directory and Exposure of Sensitive Information to an Unauthorized Actor
hbs: Insertion of Sensitive Information into Externally-Accessible File or Directory and Exposure of Sensitive Information to an Unauthorized Actor
CVE-2021-21423Medium· 6.8PoCRebuild-bot workflow may allow unauthorised repository modifications
Rebuild-bot workflow may allow unauthorised repository modifications
CVE-2019-11358Medium· 6.1⚠ ExploitedPoCXSS in jQuery as used in Drupal, Backdrop CMS, and other products
XSS in jQuery as used in Drupal, Backdrop CMS, and other products