Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
Package ecosystem npm. A cumulative reference aggregating every published CVE with an advisory in this registry; not a page of record.
| CVEs all-time | CVEs YTD | Packages affected |
|---|---|---|
| 14 | 14 | 11 |
▃█▅▅
2026-05 2 · 2026-06 6 · 2026-07 3 · 2026-08 3
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2026-55968 | 8.7 | 63.0 | — | Apache Thrift: Node.js quadratic-time DoS in server receive transports |
| CVE-2026-9277 | 9.2 | 55.3 | — | shell-quote `quote()` does not validate object-token shapes, allowing command injection… |
| CVE-2026-45249 | 6.1 | 52.1 | — | Apache ECharts: XSS in Lines series tooltip rendering |
| CVE-2026-47430 | 9.5 | 51.2 | — | Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched with… |
| CVE-2026-12143 | 8.7 | 42.9 | — | form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF inje… |
| CVE-2026-56812 | 6.3 | 41.2 | — | Phoenix JavaScript presence client crashes on presence keys colliding with Object.proto… |
| CVE-2026-13311 | 8.7 | 29.3 | — | shell-quote parse() is quadratic in token count, enabling denial of service |
| CVE-2026-13149 | 7.7 | 28.0 | — | — |
| CVE-2026-14257 | 7.5 | 27.0 | — | brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash |
| CVE-2026-5423 | 8.2 | 26.5 | — | Subscription Authentication Bypass via Unverified connectionParams.jwt |
| CVE-2026-11998 | 7.6 | 26.3 | — | AngularJS XSS via SCE resource URL sanitization bypass |
| CVE-2026-19693 | 8.1 | 20.6 | — | extract-zip arbitrary file write outside the destination directory via a symlink at the… |
| CVE-2026-19869 | 7.6 | 20.4 | — | Privilege Escalation via Dropped Field-Level @authentication |
| CVE-2026-11779 | 5.3 | 14.7 | — | PayloadCMS 3.84.1 - Authenticated account lockout bypass through default unlock access |
| Package | CVEs |
|---|---|
| @neo4j/graphql | 2 |
| brace-expansion | 2 |
| shell-quote | 2 |
| angular | 1 |
| cordova-plugin-inappbrowser | 1 |
| echarts | 1 |
| extract-zip | 1 |
| form-data | 1 |
| payload | 1 |
| phoenix | 1 |
| thrift | 1 |