# JavaScript (npm)


- [CVE-2025-68613](https://insights.sbomify.com/CVE-2025-68613/): n8n Improper Control of Dynamically-Managed Code Resources (critical 10.0, exploited in the wild)
- [CVE-2025-55182](https://insights.sbomify.com/CVE-2025-55182/): Meta React Server Components Remote Code Execution (critical 10.0, exploited in the wild)
- [CVE-2019-10758](https://insights.sbomify.com/CVE-2019-10758/): MongoDB mongo-express Remote Code Execution (critical 9.9, exploited in the wild)
- [CVE-2025-11953](https://insights.sbomify.com/CVE-2025-11953/): React Native Community CLI OS Command Injection (critical 9.8, exploited in the wild)
- [CVE-2026-45321](https://insights.sbomify.com/CVE-2026-45321/): TanStack Unspecified (critical 9.6, exploited in the wild)
- [CVE-2022-4135](https://insights.sbomify.com/CVE-2022-4135/): Google Chromium GPU Heap Buffer Overflow (critical 9.6, exploited in the wild)
- [CVE-2023-5217](https://insights.sbomify.com/CVE-2023-5217/): Google Chromium libvpx Heap Buffer Overflow (high 8.8, exploited in the wild)
- [CVE-2023-4863](https://insights.sbomify.com/CVE-2023-4863/): Google Chromium WebP Heap-Based Buffer Overflow (high 8.8, exploited in the wild)
- [CVE-2025-54313](https://insights.sbomify.com/CVE-2025-54313/): Prettier eslint-config-prettier Embedded Malicious Code (high 7.5, exploited in the wild)
- [CVE-2023-22894](https://insights.sbomify.com/CVE-2023-22894/): Strapi Cleartext Storage of Sensitive Information (high 7.2, exploited in the wild)
- [CVE-2021-21315](https://insights.sbomify.com/CVE-2021-21315/): System Information Library for Node.JS Command Injection (high 7.1, exploited in the wild)
- [CVE-2020-11023](https://insights.sbomify.com/CVE-2020-11023/): JQuery Cross-Site Scripting (XSS) (medium 6.9, exploited in the wild)

---
From sbomify Insights: https://insights.sbomify.com/ecosystems/npm/