CVE-2026-0775 | High | 7.0 | 2026-01-23 | npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected… |
CVE-2023-31999 | High | 8.8 | 2023-07-04 | All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all requests for all users. The purpose of the… |
CVE-2021-32860 | Medium | 6.1 | 2023-02-21 | iziModal is a modal plugin with jQuery. Versions prior to 1.6.1 are vulnerable to cross-site scripting (XSS) when handling untrusted modal titles. An attacker… |
CVE-2021-32855 | Medium | 6.1 | 2023-02-21 | Vditor is a browser-side Markdown editor. Versions prior to 3.8.7 are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS, the… |
CVE-2021-32854 | Medium | 6.1 | 2023-02-21 | textAngular is a text editor for Angular.js. Version 1.5.16 and prior are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS… |
CVE-2021-32853 | Medium | 6.1 | 2023-02-20 | Erxes, an experience operating system (XOS) with a set of plugins, is vulnerable to cross-site scripting in versions 0.22.3 and prior. This results in client-s… |
CVE-2021-32851 | Medium | 6.1 | 2023-02-20 | Mind-elixir is a free, open source mind map core. Prior to version 0.18.1, mind-elixir is prone to cross-site scripting when handling untrusted menus. This iss… |
CVE-2021-32850 | Medium | 6.1 | 2023-02-20 | jQuery MiniColors is a color picker built on jQuery. Prior to version 2.3.6, jQuery MiniColors is prone to cross-site scripting when handling untrusted color n… |
CVE-2022-29244 | High | 7.5 | 2022-06-13 | npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--worksp… |
CVE-2021-39135 | High | 8.2 | 2021-08-31 | `@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder hierarchy for the npm command line interface, aims to guar… |
CVE-2021-39134 | High | 8.2 | 2021-08-31 | `@npmcli/arborist`, the library that calculates dependency trees and manages the `node_modules` folder hierarchy for the npm command line interface, aims to gu… |
CVE-2021-37713 | High | 8.2 | 2021-08-31 | The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerabil… |
CVE-2021-37712 | High | 8.2 | 2021-08-31 | The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerabil… |
CVE-2021-37701 | High | 8.2 | 2021-08-31 | The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerabili… |
CVE-2021-32804 | High | 8.2 | 2021-08-03 | The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient… |
CVE-2021-32803 | High | 8.2 | 2021-08-03 | The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient sy… |
CVE-2020-15095 | Medium | 4.4 | 2020-07-07 | Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<protocol>://[<u… |
CVE-2019-16777 | High | 7.7 | 2019-12-13 | Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritt… |
CVE-2019-16776 | High | 7.7 | 2019-12-13 | Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules f… |
CVE-2019-16775 | High | 7.7 | 2019-12-13 | Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_m… |
CVE-2018-16475 | High | 7.5 | 2018-11-06 | A Path Traversal in Knightjs versions <= 0.0.1 allows an attacker to read content of arbitrary files on a remote server. |
CVE-2018-16474 | Medium | 6.1 | 2018-11-06 | A stored xss in tianma-static module versions <=1.0.4 allows an attacker to execute arbitrary javascript. |
CVE-2018-16473 | Medium | 5.3 | 2018-11-06 | A path traversal in takeapeek module versions <=0.2.2 allows an attacker to list directory and files. |
CVE-2018-16472 | High | 7.5 | 2018-11-06 | A prototype pollution attack in cached-path-relative versions <=1.0.1 allows an attacker to inject properties on Object.prototype which are then inherited by a… |
CVE-2018-11615 | High | 7.5 | 2018-08-30 | This vulnerability allows remote attackers to deny service on vulnerable installations of npm mosca 2.8.1. Authentication is not required to exploit this vulne… |