N
Vendor security profile
npm
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs823
Critical116
CISA KEV0
Public exploit271
Patch rate%47
Avg. CVSS7.1
12-month vulnerability rate
0
0
3
2
3
2
7
39
99
249
249
160
CVE KEV
CVE severity distribution
823toplam CVE
Critical116 (14%)
High356 (43%)
Medium313 (38%)
Low38 (5%)
Patch and exploitation view
%47
Verified patch
%0
CISA KEV
%33
Public exploit
375Patch available
10Partial
14Workaround
0Vendor: no patch
424Unknown
Latest vulnerabilities
9.3
CVE-2026-108261
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment
T
Patch status unknownEPSS %0
7.6
CVE-2026-108260
@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS
T
Patch status unknownEPSS %0
8.2
CVE-2026-108259
Tina: Code injection via unescaped Git branch name in generated client source
T
Patch status unknownEPSS %0
7.4
CVE-2026-107724
fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery
N
Patch status unknownEPSS %0
8.1
CVE-2026-107723
fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array
N
Patch status unknownEPSS %0
9.8
CVE-2026-107722
fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion
N
Patch status unknownEPSS %0
5.9
CVE-2026-107721
fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)
N
Patch status unknownEPSS %0
7.4
CVE-2026-107720
fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set
N
Patch status unknownEPSS %0
4.2
CVE-2026-107719
fast-jwt: Verifier cache accepts expired JWTs without iat.
N
Patch status unknownEPSS %0
6.1
CVE-2026-107718
AdonisJS: Unencoded route parameters can produce open redirects
A
Patch status unknownEPSS %0