Karma Project Karma — known CVE vulnerabilities

Every CVE whose affected-product data names Karma Project Karma, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (2)

• CVE-2022-0437 — CVSS 6.1 (medium): Cross-site Scripting (XSS) - DOM in NPM karma prior to 6.3.14.
• CVE-2021-23495 — CVSS 5.4 (medium): The package karma before 6.3.16 are vulnerable to Open Redirect due to missing validation of the return_url query parameter.