N
Vendor security profile
npm
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs834
Critical116
CISA KEV0
Public exploit279
Patch rate%65
Avg. CVSS7.1
12-month vulnerability rate
0
0
3
2
3
2
7
39
99
249
246
174
CVE KEV
CVE severity distribution
834toplam CVE
Critical116 (14%)
High362 (43%)
Medium317 (38%)
Low39 (5%)
Patch and exploitation view
%65
Verified patch
%0
CISA KEV
%33
Public exploit
528Patch available
10Partial
14Workaround
0Vendor: no patch
282Unknown
Latest vulnerabilities
7.5
CVE-2026-102599
Socket.IO: Engine.IO Protocol Revision Mismatch DoS
S
Patch status unknown
6.7
CVE-2026-102672
Electron: Local race condition in Squirrel.Mac update installation on macOS
E
Patch status unknown
6.9
CVE-2026-101899
Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges
A
Patch status unknown
5.7
CVE-2026-106108
Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory
Q
Patch status unknown
9.3
CVE-2026-108261
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment
T
Patch status unknownEPSS %0
7.6
CVE-2026-108260
@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS
T
Patch status unknownEPSS %0
8.2
CVE-2026-108259
Tina: Code injection via unescaped Git branch name in generated client source
T
Patch verifiedEPSS %0
7.4
CVE-2026-107724
fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery
N
Patch status unknownEPSS %0
8.1
CVE-2026-107723
fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array
N
Patch status unknownEPSS %0
9.8
CVE-2026-107722
fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion
N
Patch status unknownEPSS %0