npm lunary

Name: npm lunary
Brand: npm

productUS

pkg:npm/lunary

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

public exploit

EPSS ≥ 10%

by severity

1critical2high4medium0low

updated 2026-10-28

vulnerabilities (7)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2024-4146US	critical9.8OT elevated	0.54% (45th)	—	1.2.26	2024-06-08	< 1.2.26
CVE-2024-6087US	medium6.5	0.44% (38th)	—	1.4.9	2024-09-13	< 1.4.9
CVE-2024-5389US	high8.1	0.43% (37th)	—	1.4.9	2024-06-09	< 1.4.9
CVE-2024-6867US	medium6.5	0.43% (37th)	—	1.4.10	2024-09-13	< 1.4.10
CVE-2024-6582US	medium4.3OT elevated	0.42% (36th)	—	1.4.9	2024-09-13	< 1.4.9
CVE-2024-5478US	medium6.1	0.35% (28th)	—	no fix	2024-06-06	≤ 1.2.7
CVE-2024-6862US	high8.1	0.29% (22nd)	—	1.4.10	2024-09-13	< 1.4.10

The flaw types (CWEs) most of these CVEs share.

CWE-1220Insufficient Granularity of Access Control2 CVEs
CWE-284Improper Access Control1 CVEs
CWE-285Improper Authorization1 CVEs
CWE-287Improper Authentication1 CVEs
CWE-306Missing Authentication for Critical Function1 CVEs
CWE-352Cross-Site Request Forgery (CSRF)1 CVEs
CWE-639Authorization Bypass Through User-Controlled Key1 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.