npm vulnerabilities

CVEs per yearBy the year they were published

1. 20185
2. 20193
3. 20201
4. 20217
5. 20221
6. 20237
7. 20261

Newest CVEs

• CVE-2026-0775

  npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability

  npm · cli

  High7.0
• CVE-2023-31999

  All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all requests for all users. The purpose of the…

  npm · @fastify/oauth2

  High8.8
• CVE-2021-32860

  iziModal vulnerable to Cross-site Scripting

  npm · iziModal

  Medium6.1
• CVE-2021-32855

  vditor vulnerable to Cross-site Scripting

  npm · vditor

  Medium6.1
• CVE-2021-32854

  textAngular text editor vulnerable to Cross-site Scripting

  npm · textangular

  Medium6.1
• CVE-2021-32853

  Erxes vulnerable to Cross-site Scripting

  npm · erxes

  Medium6.1
• CVE-2021-32851

  jQuery MiniColors vulnerable to Cross-site Scripting

  npm · mind-elixir

  Medium6.1
• CVE-2021-32850

  jQuery MiniColors vulnerable to Cross-site Scripting

  npm · @claviska/jquery-minicolors

  Medium6.1
• CVE-2022-29244

  npm packing does not respect root-level ignore files in workspaces

  npm · npm

  High7.5
• CVE-2021-39135

  UNIX Symbolic Link (Symlink) Following in @npmcli/arborist

  npm · arborist

  High8.2