Package security advisories
Every known advisory for a package, which versions it affects and the release that fixes it. Pick a package below, or go straight to /package/npm/<name> or /package/composer/<vendor>/<name> for any other.
npm packages
Front ends, Node back ends and build tools.
- @angular/common
- @angular/core
- @apollo/server
- @babel/core
- @babel/traverse
- @clerk/nextjs
- @fortawesome/fontawesome-free
- @grpc/grpc-js
- @hapi/hapi
- @inertiajs/react
- @inertiajs/vue3
- @nestjs/core
- @prisma/client
- @remix-run/node
- @sentry/nextjs
- @sentry/node
- adm-zip
- ajv
- alpinejs
- angular
- ansi-regex
- apollo-server
- astro
- axios
- body-parser
- bootstrap
- braces
- browserify-sign
- chart.js
- cookie
- cors
- cross-spawn
- crypto-js
- css-what
- debug
- decompress
- dompurify
- dotenv
- ejs
- electron
- elliptic
- ember-source
- engine.io
- esbuild
- event-stream
- express
- fast-xml-parser
- fastify
- follow-redirects
- form-data
- gatsby
- glob
- got
- graphql
- handlebars
- hapi
- helmet
- highlight.js
- http-proxy
- http-proxy-middleware
- ioredis
- ip
- jimp
- jose
- jquery
- js-yaml
- json5
- jsonwebtoken
- jsrsasign
- knex
- koa
- laravel-mix
- loader-utils
- lodash
- lodash.template
- markdown-it
- marked
- micromatch
- minimatch
- minimist
- moment
- mongodb
- mongoose
- ms
- multer
- mysql2
- nanoid
- next
- next-auth
- node-fetch
- node-forge
- nodemailer
- nth-check
- nunjucks
- nuxt
- passport
- path-parse
- path-to-regexp
- pdfjs-dist
- pg
- playwright
- postcss
- postcss-loader
- postcss-selector-parser
- prisma
- protobufjs
- pug
- puppeteer
- qs
- react
- react-dom
- react-router
- react-router-dom
- redis
- request
- rollup
- sanitize-html
- semver
- semver-regex
- send
- sequelize
- serve-static
- sharp
- shell-quote
- socket.io
- socket.io-parser
- svelte
- sweetalert2
- tailwindcss
- tar
- terser
- three
- tough-cookie
- trim-newlines
- typescript
- ua-parser-js
- undici
- unzipper
- uuid
- validator
- vite
- vm2
- vue
- webpack
- webpack-dev-server
- word-wrap
- ws
- xlsx
- xml2js
- yaml
Composer packages
Laravel, Symfony, Statamic, Craft and the libraries under them.
- aws/aws-sdk-php
- barryvdh/laravel-dompdf
- cakephp/cakephp
- ckeditor/ckeditor
- codeigniter4/framework
- concrete5/core
- craftcms/cms
- doctrine/dbal
- doctrine/orm
- dompdf/dompdf
- drupal/core
- ezyang/htmlpurifier
- filament/filament
- firebase/php-jwt
- guzzlehttp/guzzle
- guzzlehttp/psr7
- illuminate/database
- inertiajs/inertia-laravel
- intervention/image
- laminas/laminas-diactoros
- laravel/fortify
- laravel/framework
- laravel/jetstream
- laravel/passport
- laravel/sanctum
- laravel/socialite
- lcobucci/jwt
- league/commonmark
- league/flysystem
- livewire/livewire
- maatwebsite/excel
- monolog/monolog
- nesbot/carbon
- october/system
- phpmailer/phpmailer
- phpoffice/phpspreadsheet
- phpseclib/phpseclib
- phpunit/phpunit
- pimcore/pimcore
- shopware/core
- silverstripe/framework
- slim/slim
- smarty/smarty
- spatie/laravel-medialibrary
- spatie/laravel-permission
- statamic/cms
- stripe/stripe-php
- swiftmailer/swiftmailer
- symfony/http-foundation
- symfony/http-kernel
- symfony/process
- symfony/routing
- symfony/security-http
- symfony/twig-bridge
- tinymce/tinymce
- twig/twig
- typo3/cms-core
- vlucas/phpdotenv
- wp-cli/wp-cli
- yiisoft/yii2
Check every package in every client repo at once
NPMscan reads the lockfiles in each GitHub repo you pick, npm, Yarn, pnpm and Composer, and tells you which projects have a vulnerable version and the command that fixes it.