Detection Coverage

HIGH CVE-2025-5791 7.1 This Week users@0.11.0 Privilege escalation vulnerability in the Rust 'users' crate that incorrectly includes the root group in acces HIGH CVE-2026-41676 7.2 This Week openssl@0.10.68 Memory corruption in rust-openssl's key derivation functions allows heap or stack buffer overflow when applica HIGH CVE-2026-41678 7.2 This Week openssl@0.10.68 Out-of-bounds memory write in rust-openssl's AES key unwrap function allows attackers who control buffer sizes HIGH CVE-2026-41681 8.1 This Week openssl@0.10.68 Stack-based buffer overflow in rust-openssl's MdCtxRef::digest_final() allows safe Rust code to corrupt memory HIGH CVE-2026-41898 8.3 This Week openssl@0.10.68 Buffer overflow in rust-openssl 0.9.24 through 0.10.77 allows remote unauthenticated attackers to trigger memo HIGH CVE-2026-42327 8.7 This Week openssl@0.10.68 Undefined behavior in rust-openssl's X509Ref::ocsp_responders allows crafted X.509 certificates with non-UTF-8 HIGH CVE-2026-93599 8.7 This Week rustls-webpki@0.103.3 Denial of service in rustls-webpki through 0.103.12 and in 0.104.0-alpha.1 through 0.104.0-alpha.6: a crafted MEDIUM CVE-2020-26235 5.3 This Month time@0.1.45 In Rust time crate from version 0.2.7 and before version 0.2.23, unix-like operating systems may segfault due MEDIUM CVE-2024-12224 5.1 This Month PoC idna@0.5.0 Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker MEDIUM CVE-2025-24898 6.3 This Month openssl@0.10.68 rust-openssl is a set of OpenSSL bindings for the Rust programming language. Rated medium severity (CVSS 6.3), MEDIUM CVE-2025-4574 6.5 This Month crossbeam-channel@0.5.13 Double-free vulnerability in crossbeam-channel Rust crate's Channel Drop implementation allows memory corrupti MEDIUM CVE-2026-25727 6.5 This Month time@0.3.36 The Rust time library versions 0.3.6 through 0.3.46 are vulnerable to denial of service through stack exhausti MEDIUM CVE-2026-44662 5.1 This Month openssl@0.10.68 Heap buffer overflow in rust-openssl's AES key-wrap-with-padding cipher functions allows attackers to write up MEDIUM CVE-2026-45784 5.1 This Month openssl@0.10.68 Heap corruption in rust-openssl versions 0.10.50 through 0.10.79 allows attacker-controllable out-of-bounds wr MEDIUM CVE-2026-93602 5.9 This Month rustls-webpki@0.103.3 CRL revocation-check bypass in rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 can cause revoked X. LOW CVE-2026-41677 1.7 openssl@0.10.68 Buffer over-read in rust-openssl's password callback APIs allows information disclosure when a user-supplied c LOW CVE-2026-93600 2.1 rustls-webpki@0.103.3 rustls-webpki 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 accept X.509 name con LOW CVE-2026-93601 2.1 rustls-webpki@0.103.3 Name-constraint bypass in rustls-webpki versions 0.101.0 through 0.103.11 and 0.104.0-alpha.1 through 0.104.0- Show 13 more CVEs Show less

MEDIUM CVE-2023-49092 5.9 This Month rsa@0.9.10 RustCrypto/RSA is a portable RSA implementation in pure Rust. Rated medium severity (CVSS 5.9), this vulnerabi

MEDIUM CVE-2023-49092 5.9 This Month rsa@0.9.10 RustCrypto/RSA is a portable RSA implementation in pure Rust. Rated medium severity (CVSS 5.9), this vulnerabi

CRITICAL CVE-2021-29937 9.8 Act Now PoC telemetry@0.1.0 An issue was discovered in the telemetry crate through 2021-02-17 for Rust. Rated critical severity (CVSS 9.8) MEDIUM CVE-2023-49092 5.9 This Month rsa@0.9.10 RustCrypto/RSA is a portable RSA implementation in pure Rust. Rated medium severity (CVSS 5.9), this vulnerabi

MEDIUM CVE-2023-49092 5.9 This Month rsa@0.9.10 RustCrypto/RSA is a portable RSA implementation in pure Rust. Rated medium severity (CVSS 5.9), this vulnerabi

HIGH CVE-2026-25541 7.5 This Week PoC bytes@1.10.1 Integer overflow in the Bytes library versions 1.2.1 through 1.11.0 allows attackers to corrupt the BytesMut c

HIGH CVE-2026-86428 8.7 This Week league/commonmark@2.9.1 Quadratic CPU exhaustion in league/commonmark's optional AttributesExtension (versions 1.5.0 through 2.9.2) al

CRITICAL CVE-2024-51736 9.8 Act Now symfony/process@5.3.12 Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. Rated cr HIGH CVE-2022-24775 7.5 This Week guzzlehttp/psr7@2.1.0 guzzlehttp/psr7 is a PSR-7 HTTP message library. Rated high severity (CVSS 7.5), this vulnerability is remotel HIGH CVE-2022-24894 8.8 symfony/http-kernel@5.3.12 Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony HIGH CVE-2023-29197 7.5 This Week guzzlehttp/psr7@2.1.0 guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Rated high severity (CVSS 7.5), this vu HIGH CVE-2024-47823 7.7 This Week PoC livewire/livewire@2.8.0 Livewire is a full-stack framework for Laravel that allows for dynamic UI components without leaving PHP. Rate HIGH CVE-2024-52301 8.7 This Week laravel/framework@8.73.2 Laravel is a web application framework. Rated high severity (CVSS 8.7), this vulnerability is remotely exploit HIGH CVE-2024-58382 8.7 This Week league/commonmark@2.0.2 league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing HIGH CVE-2025-64500 7.3 This Week PoC symfony/http-foundation@5.3.11 Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Rated high s HIGH CVE-2026-24765 7.8 This Week PoC phpunit/phpunit@9.5.10 Unsafe deserialization in PHPUnit versions before 8.5.52, 9.6.33, 10.5.62, 11.5.50, and 12.5.8 allows local at HIGH CVE-2026-45133 8.2 This Week symfony/yaml@5.3.11 Denial of service in the Symfony Yaml component (symfony/yaml and the symfony/symfony monolith) lets remote at HIGH CVE-2026-45304 8.7 This Week symfony/yaml@5.3.11 Uncontrolled memory consumption in the Symfony Yaml component lets remote attackers trigger a "Billion Laughs" HIGH CVE-2026-45305 8.7 This Week symfony/yaml@5.3.11 Denial of service in the Symfony Yaml component (symfony/yaml and the monolithic symfony/symfony) allows remot HIGH CVE-2026-48019 8.9 This Week laravel/framework@8.73.2 CRLF injection in Laravel Framework (CWE-93) enables unauthenticated remote attackers to manipulate outbound e HIGH CVE-2026-61815 7.2 This Week PoC zbateson/mail-mime-parser@2.1.0 CRLF header injection in zbateson/mail-mime-parser before 3.0.6 and 4.0.2 allows an attacker-influenced attach HIGH CVE-2026-61816 7.5 This Week PoC zbateson/mail-mime-parser@2.1.0 Denial of service in zbateson/mail-mime-parser 2.0.0 through 3.0.5 and 4.0.0/4.0.1 allows unauthenticated remo HIGH CVE-2026-71488 7.5 This Week league/commonmark@2.0.2 Quadratic-time denial of service in league/commonmark versions 0.6.0 through 2.8.3 allows remote unauthenticat HIGH CVE-2026-86428 8.7 This Week league/commonmark@2.0.2 Quadratic CPU exhaustion in league/commonmark's optional AttributesExtension (versions 1.5.0 through 2.9.2) al HIGH CVE-2026-86429 8.7 This Week league/commonmark@2.0.2 Quadratic parsing complexity in league/commonmark (thephpleague/commonmark, versions ≥1.5.0 and <2.9.1) allows HIGH CVE-2026-86430 8.7 This Week league/commonmark@2.0.2 Three independent super-linear parsing paths in league/commonmark before 2.9.1 allow unauthenticated remote at MEDIUM CVE-2021-43808 6.1 This Month PoC laravel/framework@8.73.2 Laravel is a web application framework. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo MEDIUM CVE-2024-50345 6.1 This Month symfony/http-foundation@5.3.11 symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for MEDIUM CVE-2025-22145 6.3 This Month nesbot/carbon@2.54.0 Carbon is an international PHP extension for DateTime. Rated medium severity (CVSS 6.3), this vulnerability is MEDIUM CVE-2025-27515 6.9 This Month laravel/framework@8.73.2 Laravel is a web application framework. Rated medium severity (CVSS 6.9), this vulnerability is remotely explo MEDIUM CVE-2025-46734 6.4 This Month league/commonmark@2.0.2 league/commonmark is a PHP Markdown parser. Rated medium severity (CVSS 6.4), this vulnerability is remotely e MEDIUM CVE-2026-24739 6.3 This Month PoC symfony/process@5.3.12 Symfony versions up to 5.4.51 contains a vulnerability that allows attackers to operations being performed on MEDIUM CVE-2026-30838 6.1 This Month league/commonmark@2.0.2 The DisallowedRawHtml extension in PHP Commonmark (league/commonmark) versions prior to 2.8.1 can be bypassed MEDIUM CVE-2026-45067 6.3 This Month symfony/mime@5.3.11 Email-header and SMTP command injection (CWE-93) in Symfony's Mime component (symfony/mime, also shipped in th MEDIUM CVE-2026-45070 6.3 This Month symfony/mime@5.3.11 Header injection in Symfony's Mime component (symfony/mime) enables attackers to inject arbitrary MIME headers MEDIUM CVE-2026-46644 6.9 This Month symfony/polyfill-intl-idn@1.23.0 Symfony's polyfill-intl-idn library (versions 1.17.1–1.38.0) silently accepts malformed Punycode ACE labels — MEDIUM CVE-2026-48784 5.1 This Month symfony/routing@5.3.11 Symfony's UrlGenerator encodes only alternating dot-segments in chained `../` or `./` sequences due to a `strt MEDIUM CVE-2026-48998 5.3 This Month guzzlehttp/psr7@2.1.0 Host confusion in guzzlehttp/psr7 (all versions prior to 2.10.2) allows unauthenticated network attackers to s MEDIUM CVE-2026-49214 5.3 This Month guzzlehttp/psr7@2.1.0 CRLF injection in guzzlehttp/psr7 versions prior to 2.10.2 allows remote unauthenticated attackers to inject a MEDIUM CVE-2026-55766 4.8 This Month guzzlehttp/psr7@2.1.0 CRLF injection in guzzlehttp/psr7 (all versions prior to 2.12.1) enables header injection, response splitting, MEDIUM CVE-2026-59882 6.5 This Month guzzlehttp/psr7@2.1.0 Host validation bypass in guzzlehttp/psr7 before 2.12.3 enables URI authority confusion attacks against PHP ap MEDIUM CVE-2026-71478 6.1 This Month league/commonmark@2.0.2 Stored XSS in league/commonmark's AttributesExtension allows remote attackers to inject and execute arbitrary LOW CVE-2026-45065 2.3 symfony/routing@5.3.11 Protocol-relative URL injection in Symfony's UrlGenerator allows open redirect via regex alternation bypass in Show 31 more CVEs Show less

HIGH CVE-2025-64500 7.3 This Week PoC symfony/http-foundation@7.3.2 Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Rated high s HIGH CVE-2026-24765 7.8 This Week PoC phpunit/phpunit@11.5.29 Unsafe deserialization in PHPUnit versions before 8.5.52, 9.6.33, 10.5.62, 11.5.50, and 12.5.8 allows local at HIGH CVE-2026-32935 8.2 This Week phpseclib/phpseclib@3.0.46 phpseclib versions 1.0.26 and below, 2.0.0 through 2.0.51, and 3.0.0 through 3.0.49 are vulnerable to a paddin HIGH CVE-2026-44167 7.5 This Week phpseclib/phpseclib@3.0.46 Denial of service attacks against PHP applications using phpseclib can be triggered by providing maliciously c HIGH CVE-2026-45068 8.7 This Week symfony/mailer@7.3.2 Argument (option) injection in Symfony Mailer's SendmailTransport lets a dash-prefixed recipient address be in HIGH CVE-2026-45133 8.2 This Week symfony/yaml@7.3.2 Denial of service in the Symfony Yaml component (symfony/yaml and the symfony/symfony monolith) lets remote at HIGH CVE-2026-45304 8.7 This Week symfony/yaml@7.3.2 Uncontrolled memory consumption in the Symfony Yaml component lets remote attackers trigger a "Billion Laughs" HIGH CVE-2026-45305 8.7 This Week symfony/yaml@7.3.2 Denial of service in the Symfony Yaml component (symfony/yaml and the monolithic symfony/symfony) allows remot HIGH CVE-2026-48019 8.9 This Week laravel/framework@12.22.1 CRLF injection in Laravel Framework (CWE-93) enables unauthenticated remote attackers to manipulate outbound e HIGH CVE-2026-67354 8.2 This Week guzzlehttp/guzzle@7.9.3 URI fragment leakage in guzzlehttp/guzzle's RedirectMiddleware (versions before 7.15.1) exposes sensitive clie HIGH CVE-2026-67355 8.2 This Week guzzlehttp/guzzle@7.9.3 Cookie scope leakage in guzzlehttp/guzzle before 7.15.1 allows an attacker controlling a child subdomain to re HIGH CVE-2026-69246 7.2 This Week PoC guzzlehttp/guzzle@7.9.3 Host confusion in GuzzleHttp Guzzle before 7.15.2 and 8.0.1 allows remote attackers who can influence a fetche HIGH CVE-2026-71488 7.5 This Week league/commonmark@2.7.1 Quadratic-time denial of service in league/commonmark versions 0.6.0 through 2.8.3 allows remote unauthenticat HIGH CVE-2026-86428 8.7 This Week league/commonmark@2.7.1 Quadratic CPU exhaustion in league/commonmark's optional AttributesExtension (versions 1.5.0 through 2.9.2) al HIGH CVE-2026-86429 8.7 This Week league/commonmark@2.7.1 Quadratic parsing complexity in league/commonmark (thephpleague/commonmark, versions ≥1.5.0 and <2.9.1) allows HIGH CVE-2026-86430 8.7 This Week league/commonmark@2.7.1 Three independent super-linear parsing paths in league/commonmark before 2.9.1 allow unauthenticated remote at MEDIUM CVE-2026-24739 6.3 This Month PoC symfony/process@7.3.0 Symfony versions up to 5.4.51 contains a vulnerability that allows attackers to operations being performed on MEDIUM CVE-2026-30838 6.1 This Month league/commonmark@2.7.1 The DisallowedRawHtml extension in PHP Commonmark (league/commonmark) versions prior to 2.8.1 can be bypassed MEDIUM CVE-2026-30964 5.4 This Month web-auth/webauthn-lib@5.2.2 The webauthn-lib PHP library before version 5.2.4 incorrectly validates origin restrictions by comparing only MEDIUM CVE-2026-33347 6.3 This Month league/commonmark@2.7.1 Mozilla's Embed extension contains a domain allowlist bypass in the DomainFilteringAdapter due to insufficient MEDIUM CVE-2026-45067 6.3 This Month symfony/mime@7.3.2 Email-header and SMTP command injection (CWE-93) in Symfony's Mime component (symfony/mime, also shipped in th MEDIUM CVE-2026-45070 6.3 This Month symfony/mime@7.3.2 Header injection in Symfony's Mime component (symfony/mime) enables attackers to inject arbitrary MIME headers MEDIUM CVE-2026-46644 6.9 This Month symfony/polyfill-intl-idn@1.32.0 Symfony's polyfill-intl-idn library (versions 1.17.1–1.38.0) silently accepts malformed Punycode ACE labels — MEDIUM CVE-2026-48736 6.9 This Month symfony/http-foundation@7.3.2 SSRF filter bypass in Symfony's NoPrivateNetworkHttpClient permits requests to private IPv4 addresses to be sm MEDIUM CVE-2026-48784 5.1 This Month symfony/routing@7.3.2 Symfony's UrlGenerator encodes only alternating dot-segments in chained `../` or `./` sequences due to a `strt MEDIUM CVE-2026-48998 5.3 This Month guzzlehttp/psr7@2.7.1 Host confusion in guzzlehttp/psr7 (all versions prior to 2.10.2) allows unauthenticated network attackers to s MEDIUM CVE-2026-49214 5.3 This Month guzzlehttp/psr7@2.7.1 CRLF injection in guzzlehttp/psr7 versions prior to 2.10.2 allows remote unauthenticated attackers to inject a MEDIUM CVE-2026-55568 5.9 This Month guzzlehttp/guzzle@7.9.3 Silent TLS downgrade in Guzzle's built-in cURL handlers exposes proxy credentials and tunneled connection meta MEDIUM CVE-2026-55599 5.8 This Month PoC phpseclib/phpseclib@3.0.46 Server-side request forgery in phpseclib's X.509 validation allows unauthenticated network attackers to force MEDIUM CVE-2026-55766 4.8 This Month guzzlehttp/psr7@2.7.1 CRLF injection in guzzlehttp/psr7 (all versions prior to 2.12.1) enables header injection, response splitting, MEDIUM CVE-2026-55767 5.8 This Month guzzlehttp/guzzle@7.9.3 Cookie domain validation in guzzlehttp/guzzle before 7.12.1 allows cross-origin cookie injection when a shared MEDIUM CVE-2026-59882 6.5 This Month guzzlehttp/psr7@2.7.1 Host validation bypass in guzzlehttp/psr7 before 2.12.3 enables URI authority confusion attacks against PHP ap MEDIUM CVE-2026-59883 6.1 This Month PoC guzzlehttp/guzzle@7.9.3 Cookie domain suffix-matching bypass in Guzzle PHP HTTP client (prior to 7.12.3) allows cross-host cookie disc MEDIUM CVE-2026-67339 6.9 This Month guzzlehttp/guzzle@7.9.3 Proxy-Authorization header leakage in guzzlehttp/guzzle before 7.14.2 allows origin servers to receive proxy c MEDIUM CVE-2026-67353 6.9 This Month guzzlehttp/guzzle@7.9.3 Denial of service in guzzlehttp/guzzle versions before 7.15.1 allows a malicious or compromised upstream serve MEDIUM CVE-2026-69245 6.5 This Month PoC guzzlehttp/guzzle@7.9.3 Cookie domain scope bypass in Guzzle PHP HTTP client (prior to 7.15.2 and 8.0.1) allows improper cookie sharin MEDIUM CVE-2026-71478 6.1 This Month league/commonmark@2.7.1 Stored XSS in league/commonmark's AttributesExtension allows remote attackers to inject and execute arbitrary MEDIUM CVE-2026-81887 5.1 This Month livewire/livewire@3.6.4 Prototype pollution in Livewire's client-side query-string parser enables reflected cross-site scripting again MEDIUM CVE-2026-86431 6.9 This Month league/commonmark@2.7.1 Cross-site scripting in league/commonmark 2.7.0-2.9.0 allows unauthenticated attackers to inject arbitrary Jav LOW CVE-2026-40194 3.7 phpseclib/phpseclib@3.0.46 phpseclib's SSH2 packet authentication uses PHP's non-constant-time != operator to compare HMACs, enabling tim LOW CVE-2026-45065 2.3 symfony/routing@7.3.2 Protocol-relative URL injection in Symfony's UrlGenerator allows open redirect via regex alternation bypass in N/A CVE-2025-45769 firebase/php-jwt@6.11.1 Vulnerability in firebase/php-jwt Show 37 more CVEs Show less

CRITICAL CVE-2026-39821 9.6 Act Now golang.org/x/net@0.46.0 Privilege escalation in Go's golang.org/x/net/idna package (all versions before 0.55.0) stems from ToASCII and CRITICAL CVE-2026-39830 9.1 Act Now PoC golang.org/x/crypto@0.43.0 Resource exhaustion in the Go golang.org/x/crypto/ssh package allows a malicious SSH peer to leak goroutines a CRITICAL CVE-2026-39831 9.1 Act Now golang.org/x/crypto@0.43.0 Authentication bypass in the Go x/crypto/ssh library (versions before 0.52.0) allows SSH servers to accept FID CRITICAL CVE-2026-39832 9.1 Act Now PoC golang.org/x/crypto@0.43.0 Constraint extension stripping in the golang.org/x/crypto SSH agent client (versions prior to 0.52.0) allows r CRITICAL CVE-2026-39833 9.1 Act Now PoC golang.org/x/crypto@0.43.0 Authentication bypass in Go's golang.org/x/crypto/ssh/agent in-memory keyring (versions before 0.52.0) allows CRITICAL CVE-2026-39834 9.1 Act Now golang.org/x/crypto@0.43.0 Denial of service in the Go golang.org/x/crypto/ssh package (versions prior to 0.52.0) occurs when an applicat CRITICAL CVE-2026-42508 9.1 Act Now golang.org/x/crypto@0.43.0 Improper certificate revocation validation in the golang.org/x/crypto/ssh/knownhosts package allows SSH connec CRITICAL CVE-2026-46595 10.0 Act Now golang.org/x/crypto@0.43.0 Authorization bypass in the Go golang.org/x/crypto/ssh package before version 0.52.0 allows remote attackers t HIGH CVE-2026-32285 7.5 This Week github.com/buger/jsonparser@1.1.1 The jsonparser library for Go fails to validate slice offsets when processing malformed JSON, enabling remote HIGH CVE-2026-33813 7.5 This Week golang.org/x/image@0.22.0 Denial of service in Go's x/image/webp library allows remote attackers to crash 32-bit applications by sending HIGH CVE-2026-33814 7.5 This Week PoC golang.org/x/net@0.46.0 Remote denial of service in Go's HTTP/2 stack (both golang.org/x/net/http2 and the net/http standard library) HIGH CVE-2026-39829 7.5 This Week PoC golang.org/x/crypto@0.43.0 Denial of service in the Go golang.org/x/crypto/ssh library before version 0.52.0 allows unauthenticated remot HIGH CVE-2026-46597 7.5 This Week PoC golang.org/x/crypto@0.43.0 Denial of service in the Go golang.org/x/crypto/ssh package (versions prior to 0.52.0) allows remote unauthent HIGH CVE-2026-46599 7.5 This Week PoC golang.org/x/image@0.22.0 Denial-of-service in the Go golang.org/x/image/tiff package (versions before 0.41.0) allows remote attackers t HIGH CVE-2026-46600 7.5 This Week PoC golang.org/x/net@0.46.0 Denial of service in the Go golang.org/x/net/dns/dnsmessage package allows remote attackers to crash any appli HIGH CVE-2026-46601 7.5 This Week golang.org/x/image@0.22.0 Denial of service in the golang.org/x/image/webp decoder (versions before 0.43.0) allows remote attackers to c HIGH CVE-2026-46602 7.5 This Week golang.org/x/image@0.22.0 Uncontrolled memory allocation in the Go golang.org/x/image/tiff decoder (versions before 0.43.0) allows a rem HIGH CVE-2026-46603 7.5 This Week golang.org/x/image@0.22.0 Memory exhaustion via crafted VP8L images affects golang.org/x/image/vp8l in all versions before 0.45.0, enabl HIGH CVE-2026-46604 7.5 This Week golang.org/x/image@0.22.0 Denial of service in the Go golang.org/x/image/tiff decoder allows remote attackers to crash any application t HIGH CVE-2026-56852 7.5 This Week PoC golang.org/x/text@0.30.0 Denial of service in the golang.org/x/text/unicode/norm package (versions before 0.39.0) allows remote attacke HIGH CVE-2026-56854 7.5 This Week golang.org/x/crypto@0.43.0 Source-address critical option enforcement in golang.org/x/crypto/ssh is incomplete, allowing remote attackers HIGH CVE-2026-56855 7.5 This Week PoC golang.org/x/crypto@0.43.0 Denial-of-service in the Go extended cryptography library's SSH package allows a malicious peer to deadlock an HIGH CVE-2026-56864 7.5 This Week golang.org/x/mod@0.30.0 Improper transparency log verification in the Go module checksum database (GOSUMDB) client allows a coordinati HIGH CVE-2026-56865 8.4 This Week golang.org/x/mod@0.30.0 Supply chain compromise of Go module environments is possible when a malicious GOPROXY serves specifically cra HIGH CVE-2026-78662 7.5 This Week PoC golang.org/x/crypto@0.43.0 Connection deadlock in golang.org/x/crypto/ssh (all versions before 0.56.0) allows a malicious remote SSH peer MEDIUM CVE-2025-47914 5.3 This Month golang.org/x/crypto@0.43.0 SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause MEDIUM CVE-2025-58181 5.3 This Month golang.org/x/crypto@0.43.0 SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the r MEDIUM CVE-2026-25680 6.5 This Month golang.org/x/net@0.46.0 Excessive CPU consumption in the golang.org/x/net/html package's HTML parser allows remote attackers to cause MEDIUM CVE-2026-25681 6.1 This Month golang.org/x/net@0.46.0 Parser-differential XSS in golang.org/x/net/html allows sanitization bypass when applications parse-sanitize-r MEDIUM CVE-2026-27136 6.1 This Month golang.org/x/net@0.46.0 Mutation XSS in golang.org/x/net/html allows attackers to bypass HTML sanitization by exploiting divergence be MEDIUM CVE-2026-33809 5.3 This Month golang.org/x/image@0.22.0 Memory exhaustion in TIFF image processing allows unauthenticated remote attackers to trigger allocation of up MEDIUM CVE-2026-33812 6.1 This Month golang.org/x/image@0.22.0 Excessive memory allocation in the golang.org/x/image/font/sfnt SFNT font parser allows denial of service when MEDIUM CVE-2026-39827 6.5 This Month PoC golang.org/x/crypto@0.43.0 Unbounded memory growth in the golang.org/x/crypto/ssh package allows an authenticated remote attacker to cras MEDIUM CVE-2026-39828 6.3 This Month PoC golang.org/x/crypto@0.43.0 SSH certificate permission enforcement in golang.org/x/crypto/ssh fails silently during multi-factor authentic MEDIUM CVE-2026-39835 5.3 This Month PoC golang.org/x/crypto@0.43.0 Unauthenticated remote clients can crash SSH servers built with golang.org/x/crypto/ssh by presenting a certif MEDIUM CVE-2026-42500 5.3 This Month golang.org/x/image@0.22.0 Panic-induced denial of service in the golang.org/x/image/bmp decoder allows remote unauthenticated attackers MEDIUM CVE-2026-42502 6.1 This Month golang.org/x/net@0.46.0 Mutation XSS in Go's golang.org/x/net/html package allows attackers to bypass HTML sanitization by exploiting MEDIUM CVE-2026-42506 6.1 This Month PoC golang.org/x/net@0.46.0 XSS sanitization bypass in Go's extended networking HTML parser (golang.org/x/net/html) allows remote unauthen MEDIUM CVE-2026-46598 5.3 This Month golang.org/x/crypto@0.43.0 Panic-induced denial of service in the golang.org/x/crypto/ssh/agent package allows remote unauthenticated att LOW CVE-2026-39824 3.3 golang.org/x/sys@0.37.0 Integer overflow in NewNTUnicodeString within the Go extended syscall package for Windows allows a local low-p Show 35 more CVEs Show less

HIGH CVE-2023-3955 8.8 This Week PoC k8s.io/mount-utils@0.0.0 A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able t HIGH CVE-2026-84445 8.7 This Week google.golang.org/grpc@1.84.0 Server process termination in gRPC-Go's xDS routing layer allows any network-reachable attacker to crash a ser MEDIUM CVE-2019-11250 6.5 This Month k8s.io/client-go@0.0.0 The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. Rated medium severit MEDIUM CVE-2020-8552 4.3 This Month k8s.io/apiserver@0.0.0 The Kubernetes API server component in versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been fou MEDIUM CVE-2020-8559 6.8 This Month PoC k8s.io/apimachinery@0.0.0 The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are MEDIUM CVE-2020-8565 5.5 This Month k8s.io/client-go@0.0.0 In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to l Show 1 more CVE Show less

HIGH CVE-2026-56854 7.5 This Week golang.org/x/crypto@0.54.0 Source-address critical option enforcement in golang.org/x/crypto/ssh is incomplete, allowing remote attackers HIGH CVE-2026-56855 7.5 This Week PoC golang.org/x/crypto@0.54.0 Denial-of-service in the Go extended cryptography library's SSH package allows a malicious peer to deadlock an HIGH CVE-2026-78662 7.5 This Week PoC golang.org/x/crypto@0.54.0 Connection deadlock in golang.org/x/crypto/ssh (all versions before 0.56.0) allows a malicious remote SSH peer MEDIUM CVE-2026-32952 5.3 This Month github.com/Azure/go-ntlmssp@0.1.0 Denial of service in go-ntlmssp (pkg:go/github.com/Azure/go-ntlmssp) versions prior to 0.1.1 allows a maliciou

HIGH CVE-2026-56855 7.5 This Week PoC golang.org/x/crypto@0.55.0 Denial-of-service in the Go extended cryptography library's SSH package allows a malicious peer to deadlock an HIGH CVE-2026-56864 7.5 This Week golang.org/x/mod@0.39.0 Improper transparency log verification in the Go module checksum database (GOSUMDB) client allows a coordinati HIGH CVE-2026-56865 8.4 This Week golang.org/x/mod@0.39.0 Supply chain compromise of Go module environments is possible when a malicious GOPROXY serves specifically cra HIGH CVE-2026-78662 7.5 This Week PoC golang.org/x/crypto@0.55.0 Connection deadlock in golang.org/x/crypto/ssh (all versions before 0.56.0) allows a malicious remote SSH peer MEDIUM CVE-2020-8911 5.6 This Month PoC github.com/aws/aws-sdk-go@1.55.8 A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. Rated medium s LOW CVE-2020-8912 2.5 PoC github.com/aws/aws-sdk-go@1.55.8 A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2 Show 1 more CVE Show less

HIGH CVE-2026-84445 8.7 This Week google.golang.org/grpc@1.84.0 Server process termination in gRPC-Go's xDS routing layer allows any network-reachable attacker to crash a ser MEDIUM CVE-2020-8911 5.6 This Month PoC github.com/aws/aws-sdk-go@1.55.8 A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. Rated medium s LOW CVE-2020-8912 2.5 PoC github.com/aws/aws-sdk-go@1.55.8 A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2

CRITICAL CVE-2020-7677 9.8 PoC thenify@3.3.0 This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by CRITICAL CVE-2020-7774 9.8 Act Now PoC y18n@4.0.0 The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution. Rated critical severity CRITICAL CVE-2020-7788 9.8 Act Now PoC ini@1.3.5 This affects the package ini before 1.3.6. Rated critical severity (CVSS 9.8), this vulnerability is remotely CRITICAL CVE-2021-42740 9.8 Act Now shell-quote@1.7.1 The shell-quote package before 1.7.3 for Node.js allows command injection. Rated critical severity (CVSS 9.8), CRITICAL CVE-2021-44906 9.8 PoC minimist@1.2.3 Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95). CRITICAL CVE-2022-37601 9.8 Act Now PoC loader-utils@1.2.3 Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name CRITICAL CVE-2025-9288 9.1 Act Now PoC sha.js@2.2.6 Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.js: through 2.4.11. Rated cri CRITICAL CVE-2026-28292 9.8 Act Now PoC simple-git@3.28.0 simple-git Node.js library has a command injection vulnerability (EPSS with patch) enabling RCE when processin CRITICAL CVE-2026-33896 9.1 Act Now PoC node-forge@1.3.1 Certificate chain spoofing in node-forge (npm) <= 1.3.3 lets an attacker present any non-CA leaf certificate a CRITICAL CVE-2026-34775 9.8 Act Now electron@23.1.2 Electron's nodeIntegrationInWorker webPreference fails to properly isolate Node.js integration in worker conte CRITICAL CVE-2026-45623 9.1 Act Now PoC postcss@6.0.23 Arbitrary file read in PostCSS (npm postcss <= 8.5.11) lets an attacker who controls CSS input embed a `/*# so CRITICAL CVE-2026-4800 9.8 Act Now PoC lodash@4.17.21 Server-side code injection in Lodash's _.template function (lodash, lodash-es, lodash-amd and lodash.template, CRITICAL CVE-2026-53486 9.1 Act Now decompress@4.2.1 Arbitrary file read and write via archive extraction in the Node.js @xhmikosr/decompress library (and the unma CRITICAL CVE-2026-54466 9.2 Act Now websocket-driver@0.7.3 Message corruption in the faye websocket-driver Node.js library (npm websocket-driver, versions < 0.7.5) lets CRITICAL CVE-2026-9277 9.2 Act Now PoC shell-quote@1.7.1 Shell command injection in the npm shell-quote library (versions >= 1.1.0, <= 1.8.3) lets attacker-influenced HIGH CVE-2018-20835 7.5 PoC tar-fs@1.16.0 A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a HIGH CVE-2020-28469 7.5 PoC glob-parent@5.1.1 This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enc HIGH CVE-2020-7662 7.5 This Week PoC websocket-extensions@0.1.3 websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. Rated hi HIGH CVE-2020-7733 7.5 This Week PoC ua-parser-js@0.7.20 The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the HIGH CVE-2020-7793 7.5 This Week PoC ua-parser-js@0.7.20 The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multi HIGH CVE-2021-23337 7.2 This Week PoC lodash@4.17.21 Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. Rated high sev HIGH CVE-2021-23343 7.5 This Week PoC path-parse@1.0.6 All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDev HIGH CVE-2021-23382 7.5 This Week PoC postcss@6.0.23 The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnota HIGH CVE-2021-27292 7.5 This Week PoC ua-parser-js@0.7.20 ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. R HIGH CVE-2021-33502 7.5 This Week normalize-url@4.3.0 The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regula HIGH CVE-2021-33623 7.5 This Week trim-newlines@1.0.0 The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expres HIGH CVE-2021-3795 7.5 This Week PoC semver-regex@2.0.0 semver-regex is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this HIGH CVE-2021-3803 7.5 This Week PoC nth-check@1.0.2 nth-check is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this vul HIGH CVE-2021-3807 7.5 This Week PoC ansi-regex@4.1.0 ansi-regex is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this vu HIGH CVE-2021-43138 7.8 PoC async@2.5.0 In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, HIGH CVE-2021-43307 7.5 PoC semver-regex@2.0.0 An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, HIGH CVE-2022-25881 7.5 PoC http-cache-semantics@3.8.1 This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicio HIGH CVE-2022-25883 7.5 PoC semver@5.7.1 Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via HIGH CVE-2022-3517 7.5 This Week minimatch@3.0.4 A vulnerability was found in the minimatch package. Rated high severity (CVSS 7.5), this vulnerability is remo HIGH CVE-2022-37599 7.5 This Week loader-utils@1.2.3 A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.j HIGH CVE-2022-37603 7.5 This Week PoC loader-utils@1.2.3 A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.j HIGH CVE-2022-46175 8.8 This Week PoC json5@1.0.1 JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e. HIGH CVE-2023-26115 7.5 This Week PoC word-wrap@1.2.3 All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to th HIGH CVE-2023-29198 8.5 This Week electron@23.1.2 Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CS HIGH CVE-2023-44402 7.0 This Week electron@23.1.2 Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML an HIGH CVE-2023-45133 8.8 This Week @babel/traverse@7.11.0 Babel is a compiler for writingJavaScript. Rated high severity (CVSS 8.8), this vulnerability is low attack co HIGH CVE-2024-12905 7.5 This Week PoC tar-fs@1.16.0 An Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a R HIGH CVE-2024-21536 7.7 This Week PoC http-proxy-middleware@2.0.6 Denial of service in http-proxy-middleware allows unauthenticated remote attackers to crash the Node.js proces HIGH CVE-2024-21538 7.7 This Week cross-spawn@4.0.2 Alpine Linux: npm fixed in 10.9.1-r0 HIGH CVE-2024-4068 7.5 This Week PoC braces@2.3.2 The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, whic HIGH CVE-2024-45296 7.5 This Week path-to-regexp@0.1.10 path-to-regexp turns path strings into a regular expressions. Rated high severity (CVSS 7.5), this vulnerabili HIGH CVE-2024-52011 7.5 This Week PoC launch-editor@2.6.0 launch-editor allows users to open files with line numbers in editor from Node.js. Rated high severity (CVSS 7 HIGH CVE-2024-52798 7.7 This Week path-to-regexp@0.1.10 path-to-regexp turns path strings into a regular expressions. Rated high severity (CVSS 7.7), this vulnerabili HIGH CVE-2025-12816 8.6 This Week PoC node-forge@1.3.1 An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenti HIGH CVE-2025-48387 8.7 This Week tar-fs@1.16.0 tar-fs versions prior to 3.0.9, 2.1.3, and 1.16.5 contain a path traversal vulnerability (CWE-22) that allows HIGH CVE-2025-59343 8.7 This Week PoC tar-fs@1.16.0 tar-fs provides filesystem bindings for tar-stream. Rated high severity (CVSS 8.7), this vulnerability is remo HIGH CVE-2025-64756 7.5 This Month PoC glob@10.2.7 Glob matches files using patterns the shell uses. Rated high severity (CVSS 7.5), this vulnerability is remote HIGH CVE-2025-66031 8.7 This Week node-forge@1.3.1 Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Rated h HIGH CVE-2025-71319 8.7 This Week image-size@1.1.1 Denial of service in the npm image-size library (versions 1.1.0-1.2.0 and 2.0.0-2.0.1) lets remote unauthentic HIGH CVE-2025-71330 8.7 This Week PoC image-size@1.1.1 Denial of service in the image-size Node.js library (versions up to and including 2.0.2) allows remote unauthe HIGH CVE-2026-12151 7.5 This Week PoC undici@5.28.4 Memory exhaustion denial of service in the undici WebSocket client (versions 6.17.0 and later) allows a malici HIGH CVE-2026-13149 7.7 This Week PoC brace-expansion@1.1.11 Denial of service in the npm brace-expansion library through version 5.0.6 allows unauthenticated remote attac HIGH CVE-2026-13311 8.7 This Week PoC shell-quote@1.7.1 Denial of service in the shell-quote Node.js library (versions prior to 1.8.5) lets remote attackers stall the HIGH CVE-2026-14257 7.5 This Week PoC brace-expansion@1.1.11 Denial of service in the brace-expansion Node.js library (through version 5.0.7) lets remote attackers crash a HIGH CVE-2026-1526 7.5 This Week undici@5.28.4 Node.js undici WebSocket client denial-of-service via decompression bomb in permessage-deflate processing allo HIGH CVE-2026-19693 8.1 extract-zip@2.0.1 Arbitrary file write outside the extraction destination is possible in extract-zip 2.0.1 and earlier due to an HIGH CVE-2026-2229 7.5 This Week undici@5.28.4 Node.js undici WebSocket client denial-of-service vulnerability allows remote attackers to crash the process b HIGH CVE-2026-26996 7.5 This Week PoC minimatch@3.0.4 Minimatch versions 10.2.0 and below suffer from catastrophic backtracking in regular expression processing whe HIGH CVE-2026-27606 8.8 This Week PoC rollup@3.29.5 Arbitrary file write via path traversal in the Rollup JavaScript module bundler lets an attacker who can influ HIGH CVE-2026-27903 7.5 This Week PoC minimatch@3.0.4 Minimatch versions before 3.1.3 through 10.2.3 suffer from catastrophic backtracking in glob pattern matching HIGH CVE-2026-27904 7.5 This Week PoC minimatch@3.0.4 Minimatch versions prior to 10.2.3 (and earlier affected versions) suffer from ReDoS vulnerabilities in nested HIGH CVE-2026-28291 8.1 This Week simple-git@3.28.0 Command injection in simple-git npm package versions ≤3.28.0 enables arbitrary code execution via crafted Git HIGH CVE-2026-29063 8.7 This Week immutable@4.0.0-rc.12 Immutable.js provides many Persistent Immutable data structures. versions up to 3.8.3 is affected by improperl HIGH CVE-2026-32141 7.5 This Week flatted@3.2.7 flatted is a circular JSON parser. versions up to 3.4.0 is affected by uncontrolled recursion (CVSS 7.5). HIGH CVE-2026-33228 8.9 This Week flatted@3.2.7 Prototype pollution in the flatted npm library (versions <= 3.4.1) lets an attacker who controls input to the HIGH CVE-2026-33671 7.5 This Week picomatch@2.2.1 picomatch, a widely-used Node.js glob pattern matching library, contains a Regular Expression Denial of Servic HIGH CVE-2026-33891 7.5 This Week node-forge@1.3.1 The node-forge cryptographic library for Node.js suffers from a complete Denial of Service condition when the HIGH CVE-2026-33894 7.5 This Week PoC node-forge@1.3.1 Signature forgery in node-forge npm package (all versions through v1.3.3) allows remote attackers to bypass RS HIGH CVE-2026-33895 7.5 This Week PoC node-forge@1.3.1 The digitalbazaar/forge npm package accepts forged Ed25519 signatures due to missing scalar canonicalization c HIGH CVE-2026-34765 8.8 This Week electron@23.1.2 Electron's window.open() handler fails to properly scope named-window lookups to the opener's browsing context HIGH CVE-2026-34768 7.8 This Week electron@23.1.2 Electron's setLoginItemSettings() function on Windows fails to quote executable paths in the Run registry key, HIGH CVE-2026-34769 8.8 This Week electron@23.1.2 Command line injection in Electron via undocumented commandLineSwitches webPreference enables sandbox escape a HIGH CVE-2026-34770 8.8 This Week electron@23.1.2 Use-after-free in Electron's powerMonitor module allows local attackers to trigger memory corruption or applic HIGH CVE-2026-34771 8.8 This Week electron@23.1.2 Use-after-free in Electron framework allows memory corruption when handling fullscreen, pointer-lock, or keybo HIGH CVE-2026-34772 8.8 This Week electron@23.1.2 Use-after-free in Electron framework allows memory corruption when native save-file dialogs remain open during HIGH CVE-2026-34773 7.5 This Week electron@23.1.2 Electron's setAsDefaultProtocolClient() on Windows fails to validate protocol names before writing to the Wind HIGH CVE-2026-34774 8.1 This Week electron@23.1.2 Use-after-free memory corruption in Electron framework (versions <39.8.1, <40.7.0, <41.0.0) allows unauthentic HIGH CVE-2026-34779 7.8 This Week electron@23.1.2 Electron's moveToApplicationsFolder() API on macOS improperly sanitizes application bundle paths in AppleScrip HIGH CVE-2026-39244 7.5 This Week adm-zip@0.4.13 Denial of service in adm-zip (a widely-used pure-JavaScript ZIP library for Node.js) before 0.5.18 lets remote HIGH CVE-2026-41907 8.1 This Week PoC uuid@3.3.2 Buffer overwrite vulnerability in uuid JavaScript library versions prior to 14.0.0 enables remote attackers to HIGH CVE-2026-44705 7.7 This Week tmp@0.1.0 Path traversal in the tmp npm package (versions < 0.2.6) lets callers escape the intended temporary directory HIGH CVE-2026-44728 7.8 This Week @babel/plugin-transform-modules-systemjs@7.25.9 Arbitrary code generation in Babel's `@babel/plugin-transform-modules-systemjs` (and `@babel/preset-env` when HIGH CVE-2026-45736 7.5 This Week ws@8.17.1 Uninitialized memory disclosure in the ws WebSocket library for Node.js (versions 8.0.0 through 8.20.0) allows HIGH CVE-2026-4867 7.5 This Week path-to-regexp@0.1.10 Catastrophic backtracking in path-to-regexp versions prior to 0.1.13 enables remote denial of service attacks HIGH CVE-2026-48779 7.5 This Week PoC ws@7.5.10 Memory exhaustion denial of service in the npm 'ws' WebSocket library allows a remote unauthenticated peer to HIGH CVE-2026-56876 8.6 extract-zip@2.0.1 Arbitrary file read/write in the Node.js extract-zip library (max-mapper/extract-zip) arises because symlink e HIGH CVE-2026-59869 7.5 This Week PoC js-yaml@3.14.1 Denial of service in js-yaml (a widely-used JavaScript YAML parser) 3.0.0-3.14.x and 4.0.0-4.2.x allows remote HIGH CVE-2026-59879 8.7 This Week immutable@4.0.0-rc.12 Denial of service in the Immutable.js JavaScript library (versions before 4.3.9 and 5.1.8) allows attackers wh HIGH CVE-2026-59880 8.7 This Week PoC immutable@4.0.0-rc.12 Uncontrolled resource consumption in Immutable.js prior to 4.3.9 and 5.1.8 lets an attacker who controls keys HIGH CVE-2026-67213 8.2 This Week PoC nanoid@3.3.7 Denial-of-service in nanoid (Nano ID) versions before 5.1.6 lets an attacker hang a Node.js/JavaScript thread HIGH CVE-2026-67214 8.2 This Week PoC nanoid@3.3.7 Denial-of-service in the nanoid JavaScript library (versions before 5.1.16) lets an attacker hang a Node.js/br HIGH CVE-2026-69152 7.5 This Week PoC brace-expansion@1.1.11 Remote denial-of-service in the brace-expansion npm library (all active version lines prior to 1.1.18, 2.1.4, HIGH CVE-2026-6951 8.2 This Week simple-git@3.28.0 Remote code execution in simple-git before 3.36.0 allows unauthenticated attackers to execute arbitrary comman HIGH CVE-2026-70601 7.5 This Week electron@23.1.2 Context isolation bypass in Electron allows untrusted web content loaded by an Electron app to escape the cont HIGH CVE-2026-70604 7.4 This Week PoC electron@23.1.2 Cross-origin read bypass in Electron's custom protocol handler exposes sensitive application data to remote pa HIGH CVE-2026-70608 7.2 This Week electron@23.1.2 Sandboxed iframe popup restriction bypass in Electron allows untrusted iframe content to open new windows or t HIGH CVE-2026-73086 7.4 This Week PoC nanoid@3.3.7 Integer overflow in nanoid's size coercion path silently corrupts the process-wide CSPRNG pool, causing every HIGH CVE-2026-73088 7.5 This Week PoC browserslist@4.14.0 Prototype pollution and denial-of-service in Browserslist prior to 4.28.7 enable attackers to crash Node.js pr HIGH CVE-2026-73089 7.5 This Week PoC browserslist@4.14.0 Unbounded in-memory caches in Browserslist prior to 4.28.7 allow unauthenticated remote denial-of-service via HIGH CVE-2026-73646 7.5 This Week postcss@6.0.23 Path traversal in PostCSS's automatic source map loading allows arbitrary `.map` file disclosure when untruste HIGH CVE-2026-73650 8.2 This Week PoC svgo@1.3.2 Cross-site scripting in SVGO's script-removal plugin exposes web applications that process untrusted SVG uploa HIGH CVE-2026-77301 7.5 This Week PoC adm-zip@0.4.13 Memory exhaustion in the adm-zip Node.js library before 0.6.1 allows remote, unauthenticated attackers to cras HIGH CVE-2026-84370 8.2 This Week svgo@1.3.2 Incomplete script filtering in SVGO's opt-in removeScripts plugin allows stored XSS to survive the sanitizatio HIGH CVE-2026-84375 7.5 This Week PoC js-yaml@3.14.1 Uncontrolled CPU consumption in js-yaml versions 3.0.0-3.15.1 and 4.0.0-4.3.1 allows unauthenticated remote at HIGH CVE-2026-85393 8.7 This Week node-forge@1.3.1 RSA PKCS#1 v1.5 signature forgery in node-forge through v1.4.0 enables unauthenticated network attackers to cr MEDIUM CVE-2017-16137 5.3 debug@4.1.1 The debug module is vulnerable to regular expression denial of service when untrusted user input is passed int MEDIUM CVE-2020-15366 5.6 This Month ajv@6.12.2 An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. Rated medium seve MEDIUM CVE-2020-8244 6.5 This Month PoC bl@1.2.1 A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker MEDIUM CVE-2021-23364 5.3 This Month PoC browserslist@4.14.0 The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service ( MEDIUM CVE-2021-26920 6.5 This Month fast-xml-parser@3.19.0 In the Druid ingestion system, the InputSource is used for reading data from a certain data source. Rated medi MEDIUM CVE-2022-33987 5.3 This Month got@7.1.0 The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket. Rated med MEDIUM CVE-2022-36313 5.5 This Month PoC file-type@14.7.1 A malformed MKV file can trigger an infinite loop in the file-type Node.js package (versions before 16.5.4 and MEDIUM CVE-2023-0842 5.3 This Month PoC xml2js@0.4.19 xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. Rated medium sev MEDIUM CVE-2023-26920 6.5 This Month PoC fast-xml-parser@3.19.0 fast-xml-parser before 4.1.2 allows __proto__ for Prototype Pollution. Rated medium severity (CVSS 6.5), this MEDIUM CVE-2023-39956 6.6 This Month electron@23.1.2 Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CS MEDIUM CVE-2023-44270 5.3 This Month postcss@6.0.23 An issue was discovered in PostCSS before 8.4.31. Rated medium severity (CVSS 5.3), this vulnerability is remo MEDIUM CVE-2024-11831 5.4 This Month serialize-javascript@6.0.1 A flaw was found in npm-serialize-javascript. Rated medium severity (CVSS 5.4), this vulnerability is remotely MEDIUM CVE-2024-4067 5.3 This Month PoC micromatch@3.1.10 The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). Rat MEDIUM CVE-2024-43788 6.1 This Month PoC webpack@5.82.1 Webpack is a module bundler. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no MEDIUM CVE-2024-47764 6.9 This Month cookie@0.3.1 cookie is a basic HTTP cookie parser and serializer for HTTP servers. Rated medium severity (CVSS 6.9), this v MEDIUM CVE-2024-55565 4.3 This Month nanoid@3.3.7 nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. Rated medium severity (CVSS 4.3), this vulner MEDIUM CVE-2025-13465 6.9 This Month PoC lodash@4.17.21 Lodash versions up to 4.17.22 is affected by improperly controlled modification of object prototype attributes MEDIUM CVE-2025-22150 6.8 This Month undici@5.28.4 Undici is an HTTP/1.1 client. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, no MEDIUM CVE-2025-25288 5.3 This Month @octokit/plugin-paginate-rest@2.21.3 @octokit/plugin-paginate-rest is the Octokit plugin to paginate REST API endpoint responses. Rated medium seve MEDIUM CVE-2025-25289 5.3 This Month @octokit/request-error@2.1.0 @octokit/request-error is an error class for Octokit request errors. Rated medium severity (CVSS 5.3), this vu MEDIUM CVE-2025-25290 5.3 This Month @octokit/request@5.6.3 @octokit/request sends parameterized requests to GitHub’s APIs with sensible defaults in browsers and Node. Ra MEDIUM CVE-2025-27789 6.2 This Month PoC @babel/helpers@7.24.5 Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and MEDIUM CVE-2025-30359 5.3 This Month PoC webpack-dev-server@4.15.0 A remote code execution vulnerability in webpack-dev-server (CVSS 5.3) that allows users. Risk factors: public MEDIUM CVE-2025-30360 6.5 This Month PoC webpack-dev-server@4.15.0 webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior t MEDIUM CVE-2025-32996 4.0 This Month http-proxy-middleware@2.0.6 In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is MEDIUM CVE-2025-32997 4.0 This Month http-proxy-middleware@2.0.6 In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has fai MEDIUM CVE-2025-55305 6.1 This Month PoC electron@23.1.2 Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Rated MEDIUM CVE-2025-64718 5.3 This Month js-yaml@3.14.1 js-yaml is a JavaScript YAML parser and dumper. Rated medium severity (CVSS 5.3), this vulnerability is remote MEDIUM CVE-2025-66030 6.3 This Month node-forge@1.3.1 Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Rated m MEDIUM CVE-2026-10732 5.6 This Month decompress@4.2.1 Arbitrary file write in the npm decompress package (all versions) exploits a second-generation Zip Slip bypass MEDIUM CVE-2026-12590 5.9 This Month PoC body-parser@1.20.3 Denial of service in body-parser npm middleware allows unauthenticated remote attackers to submit arbitrarily MEDIUM CVE-2026-14620 4.7 This Month PoC webpack-dev-server@4.15.0 Cross-site request forgery in webpack-dev-server 5.2.5 and earlier allows any website visited by a developer t MEDIUM CVE-2026-14631 5.3 This Month webpack-dev-server@4.15.0 webpack-dev-server 5.2.5 and earlier crash the entire Node.js host process when an unauthenticated remote peer MEDIUM CVE-2026-15157 5.4 This Month PoC undici@5.28.4 CRLF injection in undici's HTTP/1.1 dispatcher enables HTTP header injection and potential request smuggling w MEDIUM CVE-2026-1525 6.5 This Month undici@5.28.4 Undici fails to normalize HTTP header names when processing arrays, allowing duplicate Content-Length headers MEDIUM CVE-2026-1527 4.6 This Month undici@5.28.4 CRLF injection in undici's HTTP upgrade handling allows authenticated attackers to inject arbitrary headers an MEDIUM CVE-2026-16728 6.5 This Month PoC undici@5.28.4 Response body/Content-Length desynchronization in undici's retry interceptor allows a malicious or faulty upst MEDIUM CVE-2026-16729 6.5 This Month PoC undici@5.28.4 Cookie attribute injection in undici's setCookie function allows attacker-controlled domain values or unparsed MEDIUM CVE-2026-22036 5.9 This Month undici@5.28.4 Undici versions up to 7.18.0 is affected by allocation of resources without limits or throttling (CVSS 5.9). MEDIUM CVE-2026-2950 5.3 This Month lodash@4.17.21 Prototype pollution in Lodash 4.17.23 and earlier allows unauthenticated remote attackers to delete properties MEDIUM CVE-2026-31808 5.3 This Month file-type@14.7.1 Denial of service in file-type library versions prior to 21.3.1 allows remote attackers to hang Node.js event MEDIUM CVE-2026-33672 5.3 This Month picomatch@2.2.1 picomatch is vulnerable to a method injection vulnerability (CWE-1321) in its POSIX_REGEX_SOURCE object that a MEDIUM CVE-2026-33750 6.5 This Month brace-expansion@1.1.11 Brace-expansion library versions prior to 5.0.5 allow unauthenticated remote attackers to cause denial of serv MEDIUM CVE-2026-34043 5.9 This Month serialize-javascript@6.0.1 The serialize-javascript npm library versions prior to 7.0.5 contain a CPU exhaustion denial-of-service vulner MEDIUM CVE-2026-34766 5.4 This Month electron@23.1.2 Electron's WebUSB device selection handler fails to validate chosen device IDs against renderer-requested filt MEDIUM CVE-2026-34767 6.5 This Month electron@23.1.2 HTTP response header injection in Electron allows remote attackers to inject malicious headers via crafted inp MEDIUM CVE-2026-34776 5.3 This Month electron@23.1.2 Out-of-bounds heap read in Electron's single-instance lock mechanism on macOS and Linux allows local attackers MEDIUM CVE-2026-34777 5.4 This Month electron@23.1.2 Electron versions prior to 38.8.6, 39.8.1, 40.8.1, and 41.0.0 pass the top-level page origin instead of the re MEDIUM CVE-2026-34778 6.5 This Month electron@23.1.2 Electron's service worker implementation allows spoofing of internal IPC reply messages, enabling a malicious MEDIUM CVE-2026-39243 5.5 This Month decompress@4.2.1 Arbitrary hardlink creation in the decompress npm package (before version 4.2.2) enables read disclosure and o MEDIUM CVE-2026-40895 6.9 This Month follow-redirects@1.15.6 Custom authentication header leakage in follow-redirects before 1.16.0 exposes API keys and session tokens whe MEDIUM CVE-2026-41305 6.1 This Month postcss@6.0.23 PostCSS versions prior to 8.5.10 fail to escape `</style>` sequences when stringifying CSS Abstract Syntax Tre MEDIUM CVE-2026-41650 6.1 This Month fast-xml-parser@3.19.0 fast-xml-parser XMLBuilder fails to escape comment and CDATA delimiters when building XML from JavaScript obje MEDIUM CVE-2026-45822 6.6 This Month decode-uri-component@0.2.2 Super-linear algorithmic complexity in the decode-uri-component npm package (versions through 0.4.1) allows un MEDIUM CVE-2026-53550 5.3 This Month js-yaml@3.14.1 Quadratic CPU exhaustion in js-yaml (npm) versions 4.1.1 and earlier allows unauthenticated remote attackers t MEDIUM CVE-2026-53632 5.5 This Month launch-editor@2.6.0 NTLMv2 hash disclosure in the `launch-editor` NPM package (v2.14.0 and earlier) exposes developer credentials MEDIUM CVE-2026-54490 6.3 This Month websocket-driver@0.7.3 Resource limit bypass in the websocket-driver npm library (versions < 0.7.5) allows WebSocket messages to exce MEDIUM CVE-2026-55602 6.9 This Month http-proxy-middleware@2.0.6 Backend routing bypass in http-proxy-middleware allows unauthenticated external attackers to redirect HTTP req MEDIUM CVE-2026-5758 6.5 This Month protocol-buffers-schema@3.3.2 Prototype pollution in mafintosh's protocol-buffers-schema 3.6.0 allows remote attackers to inject arbitrary p MEDIUM CVE-2026-6402 5.3 This Month PoC webpack-dev-server@4.15.0 Cross-origin source code exposure in webpack-dev-server up to 5.2.3 allows attackers controlling a malicious w MEDIUM CVE-2026-69153 6.3 This Month PoC postcss@6.0.23 Path traversal in PostCSS npm package (versions through 8.5.22) allows disclosure of arbitrary `.map` files fr MEDIUM CVE-2026-70597 6.3 This Month electron@23.1.2 Parent process code-sign spoofing in Electron on macOS allows a local low-privileged attacker to bypass fuse-b MEDIUM CVE-2026-70599 5.9 This Month electron@23.1.2 Electron's permission check handler incorrectly exposes cross-origin iframes to unauthorized camera, microphon MEDIUM CVE-2026-70602 6.6 This Month electron@23.1.2 Session isolation bypass in Electron allows a malicious or compromised Chrome extension loaded into one sessio MEDIUM CVE-2026-70603 6.0 This Month electron@23.1.2 Path validation bypass in Electron's shell.openPath() allows an attacker-controlled file to be opened in place MEDIUM CVE-2026-70605 5.9 This Month electron@23.1.2 Unrestricted HTTP redirect scheme following in Electron's net module (versions prior to 39.8.8, 40.9.0, 41.2.1 MEDIUM CVE-2026-70607 5.3 This Month PoC electron@23.1.2 Electron's window.open() features string parsing forwards untrusted BrowserWindowConstructorOptions directly t MEDIUM CVE-2026-70609 5.7 This Month electron@23.1.2 Code injection in Electron's DevTools API permits arbitrary script execution in the DevTools context via an un MEDIUM CVE-2026-70610 5.4 This Month PoC electron@23.1.2 Prototype pollution via Electron's contextBridge allows untrusted renderer-side web content to smuggle a malic MEDIUM CVE-2026-70611 6.9 This Month PoC electron@23.1.2 Native code execution outside the Chromium sandbox is achievable in Electron prior to 39.8.9, 40.9.2, 41.2.1, MEDIUM CVE-2026-70612 5.4 This Month PoC electron@23.1.2 External protocol handler bypass in Electron allows sandboxed iframes to launch OS-registered external applica MEDIUM CVE-2026-76845 6.8 This Month adm-zip@0.5.14 Symlink-following during ZIP extraction in adm-zip 0.5.9 through 0.6.0 allows a local attacker who can plant a MEDIUM CVE-2026-82417 6.3 This Month PoC qs@6.13.0 The `qs.stringify` function in the qs Node.js query-string library throws an uncaught `TypeError` when seriali MEDIUM CVE-2026-84369 6.1 This Month svgo@1.3.2 Cross-site scripting in SVGO's opt-in removeScripts plugin allows XSS payloads embedded inside SVG foreignObje MEDIUM CVE-2026-8723 6.3 This Month qs@6.13.0 The qs Node.js library (versions 6.11.1 through 6.15.1) crashes with a synchronous TypeError when stringify is MEDIUM CVE-2026-9595 4.3 This Month webpack-dev-server@4.15.0 webpack-dev-server's WebSocket upgrade handler, when a proxy entry is configured with a broad path context (/) MEDIUM CVE-2026-9679 5.9 This Month undici@5.28.4 HTTP response header injection in undici's cookie parser exposes proxy, middleware, and SSR framework applicat LOW CVE-2025-47279 3.1 undici@5.28.4 Undici is an HTTP/1.1 client for Node.js. Rated low severity (CVSS 3.1), this vulnerability is remotely exploi LOW CVE-2025-54798 2.5 PoC tmp@0.1.0 tmp is a temporary file and directory creator for node.js. Rated low severity (CVSS 2.5). Public exploit code LOW CVE-2025-5889 1.3 brace-expansion@1.1.11 Inefficient regular expression complexity in brace-expansion up to versions 1.1.11/2.0.1/3.0.0/4.0.0 allows re LOW CVE-2025-68157 3.7 PoC webpack@5.82.1 Webpack is a module bundler. From version 5.49.0 to before 5.104.0, when experiments.buildHttp is enabled, web LOW CVE-2025-68458 3.7 PoC webpack@5.82.1 Webpack is a module bundler. From version 5.49.0 to before 5.104.1, when experiments.buildHttp is enabled, web LOW CVE-2025-69873 2.9 PoC ajv@6.12.2 ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS LOW CVE-2026-11525 3.7 undici@5.28.4 SameSite attribute parsing in undici's cookie implementation uses substring matching instead of the case-insen LOW CVE-2026-2391 3.7 PoC qs@6.13.0 ### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true LOW CVE-2026-24001 2.7 diff@5.1.0 Denial-of-service in jsdiff versions prior to 8.0.3, 5.2.2, 4.0.4, and 3.5.1 allows unauthenticated remote att LOW CVE-2026-34781 3.3 electron@23.1.2 Denial of service in Electron's clipboard.readImage() allows local authenticated attackers to crash applicatio LOW CVE-2026-41988 2.5 uuid@3.3.2 UUID library versions before 14.0.0 make unexpected writes to external output buffers when generating UUID ver LOW CVE-2026-49356 3.6 @babel/core@7.20.12 Arbitrary source map file read in @babel/core allows an attacker who controls Babel's input source code to exf LOW CVE-2026-6733 3.7 undici@5.28.4 Response queue poisoning in Undici's HTTP/1.1 client allows an attacker-controlled or compromised upstream ser LOW CVE-2026-70598 3.9 electron@23.1.2 Out-of-bounds memory read in Electron's offscreen rendering pipeline allows a compromised GPU process to cause LOW CVE-2026-70600 3.1 electron@23.1.2 Cross-origin iframe autofill popup positioning in Electron allows a malicious iframe to render the native auto N/A CVE-2022-0235 node-fetch@1.7.3 Vulnerability in node-fetch N/A CVE-2024-46993 This Week electron@23.1.2 Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML an N/A CVE-2025-15284 qs@6.13.0 Vulnerability in qs N/A CVE-2025-59288 playwright@1.51.1 Vulnerability in playwright N/A CVE-2025-7339 on-headers@1.0.2 Vulnerability in on-headers Show 202 more CVEs Show less

CRITICAL CVE-2019-10744 9.1 Act Now PoC lodash@3.10.1 Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. Rated critical severity (CVSS 9.1 CRITICAL CVE-2020-7768 9.8 Act Now @grpc/grpc-js@0.8.1 The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution v CRITICAL CVE-2020-7774 9.8 Act Now PoC y18n@4.0.0 The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution. Rated critical severity CRITICAL CVE-2021-23807 9.8 Act Now PoC jsonpointer@4.1.0 This affects the package jsonpointer before 5.0.0. Rated critical severity (CVSS 9.8), this vulnerability is r CRITICAL CVE-2021-3918 9.8 Act Now PoC json-schema@0.2.3 json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pol CRITICAL CVE-2022-37601 9.8 Act Now PoC loader-utils@1.4.0 Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name CRITICAL CVE-2023-26136 9.8 Act Now PoC tough-cookie@2.5.0 Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handli CRITICAL CVE-2023-36665 9.8 Act Now PoC protobufjs@6.11.2 "protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerab CRITICAL CVE-2024-42461 9.1 Act Now elliptic@6.5.3 In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures CRITICAL CVE-2024-48949 9.1 Act Now elliptic@6.5.3 The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig CRITICAL CVE-2025-6545 9.1 Act Now pbkdf2@3.1.1 CVE-2025-6545 is an improper input validation vulnerability in the pbkdf2 library (versions 3.0.10 through 3.1 CRITICAL CVE-2025-6547 9.1 Act Now pbkdf2@3.1.1 CVE-2025-6547 is an improper input validation vulnerability in the pbkdf2 cryptographic library (versions ≤3.1 CRITICAL CVE-2025-9287 9.1 Act Now PoC cipher-base@1.0.4 Improper Input Validation vulnerability in cipher-base allows Input Data Manipulation.0.4. Rated critical seve CRITICAL CVE-2025-9288 9.1 Act Now PoC sha.js@2.4.11 Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.js: through 2.4.11. Rated cri CRITICAL CVE-2026-13697 9.1 Act Now undici@7.22.0 Cross-user information disclosure and a parse-time denial of service in undici's HTTP cache interceptor affect CRITICAL CVE-2026-33896 9.1 Act Now PoC node-forge@1.3.1 Certificate chain spoofing in node-forge (npm) <= 1.3.3 lets an attacker present any non-CA leaf certificate a CRITICAL CVE-2026-33937 9.8 Act Now handlebars@4.7.7 Remote code execution in Handlebars.js npm package allows unauthenticated attackers to execute arbitrary JavaS CRITICAL CVE-2026-41242 9.4 Act Now PoC protobufjs@6.11.2 Code injection vulnerability in protobufjs (JavaScript protobuf library) allows authenticated attackers to exe CRITICAL CVE-2026-42043 10.0 Act Now PoC axios@0.26.1 NO_PROXY protection bypass in Axios HTTP client (versions 1.0.0-1.15.0 and ≤0.31.0) lets an attacker who contr CRITICAL CVE-2026-42044 9.1 Act Now PoC axios@1.13.2 JSON response tampering in the Axios HTTP client (versions 1.0.0 up to but not including 1.15.2) lets an attac CRITICAL CVE-2026-42264 9.1 Act Now axios@1.13.2 Prototype pollution read-side gadgets in the axios HTTP adapter (npm, versions >=1.0.0 to <1.15.2) allow an at CRITICAL CVE-2026-4800 9.8 Act Now PoC lodash@3.10.1 Server-side code injection in Lodash's _.template function (lodash, lodash-es, lodash-amd and lodash.template, CRITICAL CVE-2026-54466 9.2 Act Now websocket-driver@0.7.4 Message corruption in the faye websocket-driver Node.js library (npm websocket-driver, versions < 0.7.5) lets CRITICAL CVE-2026-59873 9.2 Act Now PoC tar@6.2.1 Uncontrolled resource consumption in node-tar before 7.5.19 lets a small crafted gzip bomb exhaust disk space CRITICAL CVE-2026-75604 9.0 Act Now PoC next@16.2.3 Path traversal in Next.js (13.4.0 through 15.5.23 and 16.x before 16.3.3) running on Windows-hosted servers le CRITICAL CVE-2026-9277 9.2 Act Now PoC shell-quote@1.7.3 Shell command injection in the npm shell-quote library (versions >= 1.1.0, <= 1.8.3) lets attacker-influenced HIGH CVE-2020-7662 7.5 This Week PoC websocket-extensions@0.1.3 websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. Rated hi HIGH CVE-2020-7753 7.5 This Week PoC trim@0.0.1 All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim(). Rated HIGH CVE-2020-8116 7.3 This Week PoC dot-prop@4.2.0 Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 HIGH CVE-2020-8203 7.4 This Week PoC lodash@3.10.1 Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20. Rated high severity (CVSS 7.4) HIGH CVE-2021-23337 7.2 This Week PoC lodash@3.10.1 Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. Rated high sev HIGH CVE-2021-28092 7.5 This Week is-svg@3.0.0 The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Exp HIGH CVE-2021-29059 7.5 This Week PoC is-svg@3.0.0 A vulnerability was discovered in IS-SVG version 2.1.0 to 4.2.2 and below where a Regular Expression Denial of HIGH CVE-2021-33502 7.5 This Week normalize-url@4.5.0 The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regula HIGH CVE-2021-33587 7.5 This Week css-what@5.0.0 The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Co HIGH CVE-2021-33623 7.5 This Week trim-newlines@3.0.0 The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expres HIGH CVE-2021-3803 7.5 This Week PoC nth-check@1.0.2 nth-check is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this vul HIGH CVE-2021-3807 7.5 This Week PoC ansi-regex@4.1.0 ansi-regex is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this vu HIGH CVE-2022-21222 7.5 This Week PoC css-what@1.0.0 The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the us HIGH CVE-2022-24785 7.5 This Week moment@2.24.0 Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Rated high HIGH CVE-2022-24999 7.5 This Week PoC qs@6.5.2 qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node proces HIGH CVE-2022-25878 7.5 This Week PoC protobufjs@6.11.2 The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/ HIGH CVE-2022-25881 7.5 PoC http-cache-semantics@4.1.0 This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicio HIGH CVE-2022-25883 7.5 PoC semver@5.7.1 Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via HIGH CVE-2022-25901 7.5 PoC cookiejar@2.1.2 Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) HIGH CVE-2022-31129 7.5 This Week PoC moment@2.24.0 moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Rated high se HIGH CVE-2022-3517 7.5 This Week minimatch@3.0.4 A vulnerability was found in the minimatch package. Rated high severity (CVSS 7.5), this vulnerability is remo HIGH CVE-2022-37599 7.5 This Week loader-utils@1.4.0 A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.j HIGH CVE-2022-37603 7.5 This Week PoC loader-utils@1.4.0 A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.j HIGH CVE-2022-38900 7.5 This Week PoC decode-uri-component@0.2.0 decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS. Rated high severity (C HIGH CVE-2023-26159 7.3 This Week PoC follow-redirects@1.9.0 Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the HIGH CVE-2023-46234 7.5 This Week browserify-sign@4.2.0 browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of thi HIGH CVE-2023-50728 7.5 This Week octokit@3.1.0 octokit/webhooks is a GitHub webhook events toolset for Node.js. Rated high severity (CVSS 7.5), this vulnerab HIGH CVE-2024-21538 7.7 This Week cross-spawn@6.0.5 Alpine Linux: npm fixed in 10.9.1-r0 HIGH CVE-2024-37890 7.5 This Week ws@7.5.3 ws is an open source WebSocket client and server for Node.js. Rated high severity (CVSS 7.5), this vulnerabili HIGH CVE-2024-4068 7.5 This Week PoC braces@3.0.2 The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, whic HIGH CVE-2024-45296 7.5 This Week path-to-regexp@0.1.12 path-to-regexp turns path strings into a regular expressions. Rated high severity (CVSS 7.5), this vulnerabili HIGH CVE-2024-45590 7.5 This Week body-parser@1.19.0 body-parser is Node.js body parsing middleware. Rated high severity (CVSS 7.5), this vulnerability is remotely HIGH CVE-2024-52798 7.7 This Week path-to-regexp@0.1.7 path-to-regexp turns path strings into a regular expressions. Rated high severity (CVSS 7.7), this vulnerabili HIGH CVE-2025-12816 8.6 This Week PoC node-forge@1.3.1 An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenti HIGH CVE-2025-27152 7.7 This Week PoC axios@0.26.1 axios is a promise based HTTP client for the browser and node.js. Rated high severity (CVSS 7.7), this vulnera HIGH CVE-2025-57820 7.9 This Week devalue@2.0.1 Svelte devalue is a utility library. Rated high severity (CVSS 7.9), this vulnerability is remotely exploitabl HIGH CVE-2025-58754 7.5 This Week PoC axios@1.7.9 Axios is a promise based HTTP client for the browser and Node.js. Rated high severity (CVSS 7.5), this vulnera HIGH CVE-2025-64756 7.5 This Month PoC glob@10.4.5 Glob matches files using patterns the shell uses. Rated high severity (CVSS 7.5), this vulnerability is remote HIGH CVE-2025-65945 7.5 This Week PoC jws@3.2.2 auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4 HIGH CVE-2025-66031 8.7 This Week node-forge@1.3.1 Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Rated h HIGH CVE-2025-66414 8.1 This Week @modelcontextprotocol/sdk@1.18.1 A security vulnerability in MCP TypeScript SDK (CVSS 8.1) that allows dns rebinding protection. High severity HIGH CVE-2025-68429 7.3 This Week storybook@8.6.0 Information disclosure in Storybook for Node.js versions 7.0.0 through 10.1.9 exposes environment variables fr HIGH CVE-2025-71329 8.7 PoC image-size@1.2.1 Denial of service in the image-size Node.js library through version 2.0.2 allows remote unauthenticated attack HIGH CVE-2025-71330 8.7 This Week PoC image-size@1.2.1 Denial of service in the image-size Node.js library (versions up to and including 2.0.2) allows remote unauthe HIGH CVE-2026-0621 8.7 This Week PoC @modelcontextprotocol/sdk@1.18.1 Denial of service in Anthropic's Model Context Protocol (MCP) TypeScript SDK versions up to and including 1.25 HIGH CVE-2026-12143 8.7 This Week form-data@2.3.3 CRLF injection in the form-data Node.js library (versions through 4.0.5) allows remote attackers to inject arb HIGH CVE-2026-12151 7.5 This Week PoC undici@5.26.3 Memory exhaustion denial of service in the undici WebSocket client (versions 6.17.0 and later) allows a malici HIGH CVE-2026-13149 7.7 This Week PoC brace-expansion@1.1.11 Denial of service in the npm brace-expansion library through version 5.0.6 allows unauthenticated remote attac HIGH CVE-2026-13311 8.7 This Week PoC shell-quote@1.7.3 Denial of service in the shell-quote Node.js library (versions prior to 1.8.5) lets remote attackers stall the HIGH CVE-2026-13676 7.5 This Week PoC fast-uri@3.0.2 Host-based security policy bypass in the fast-uri Node.js URI parser (versions 2.3.1 through 3.1.2 and 4.0.0) HIGH CVE-2026-14257 7.5 This Week PoC brace-expansion@1.1.11 Denial of service in the brace-expansion Node.js library (through version 5.0.7) lets remote attackers crash a HIGH CVE-2026-14643 7.5 This Week PoC undici@7.22.0 Cross-user information disclosure in undici's cache interceptor allows authenticated users' responses to be se HIGH CVE-2026-1526 7.5 This Week undici@5.26.3 Node.js undici WebSocket client denial-of-service via decompression bomb in permessage-deflate processing allo HIGH CVE-2026-1528 7.5 This Week undici@7.22.0 Undici's WebSocket frame parser fails to properly validate 64-bit length fields, causing integer overflow in i HIGH CVE-2026-16221 7.5 This Week PoC fast-uri@3.0.2 Host-based policy bypass in the fast-uri Node.js URI parser (versions 2.3.1 through 4.1.0, spanning the 2.x li HIGH CVE-2026-18446 7.5 This Week PoC fast-uri@3.0.2 Security filter bypass in fast-uri (before versions 4.1.2, 3.1.5, and 2.4.4) enables unauthenticated remote at HIGH CVE-2026-2229 7.5 This Week undici@5.26.3 Node.js undici WebSocket client denial-of-service vulnerability allows remote attackers to crash the process b HIGH CVE-2026-23745 8.2 This Week PoC tar@6.2.1 Arbitrary file overwrite and symlink poisoning in the node-tar library (versions <= 7.5.2) lets a malicious ta HIGH CVE-2026-24842 8.2 This Week PoC tar@6.2.1 node-tar before version 7.5.7 contains a path traversal vulnerability where inconsistent path resolution betwe HIGH CVE-2026-25536 7.1 This Week PoC @modelcontextprotocol/sdk@1.18.1 MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. [CVSS 7.1 HI HIGH CVE-2026-25639 7.5 This Week PoC axios@0.26.1 Axios versions up to 0.30.3 is affected by improper check for unusual or exceptional conditions (CVSS 7.5). HIGH CVE-2026-26960 7.1 This Week PoC tar@6.2.1 Path traversal in node-tar versions 7.5.7 and earlier allows local attackers to read and write arbitrary files HIGH CVE-2026-26996 7.5 This Week PoC minimatch@3.0.4 Minimatch versions 10.2.0 and below suffer from catastrophic backtracking in regular expression processing whe HIGH CVE-2026-27148 8.9 This Week storybook@8.6.0 Cross-site WebSocket hijacking leading to persistent XSS and Remote Code Execution affects Storybook's dev ser HIGH CVE-2026-27606 8.8 This Week PoC rollup@2.35.1 Arbitrary file write via path traversal in the Rollup JavaScript module bundler lets an attacker who can influ HIGH CVE-2026-27903 7.5 This Week PoC minimatch@3.0.4 Minimatch versions before 3.1.3 through 10.2.3 suffer from catastrophic backtracking in glob pattern matching HIGH CVE-2026-27904 7.5 This Week PoC minimatch@3.0.4 Minimatch versions prior to 10.2.3 (and earlier affected versions) suffer from ReDoS vulnerabilities in nested HIGH CVE-2026-29063 8.7 This Week immutable@4.1.0 Immutable.js provides many Persistent Immutable data structures. versions up to 3.8.3 is affected by improperl HIGH CVE-2026-29074 7.5 This Week PoC svgo@3.3.2 Denial of service in SVGO versions 2.1.0-2.8.0, 3.0.0-3.3.2, and before 4.0.1 allows unauthenticated attackers HIGH CVE-2026-29786 8.2 This Week PoC tar@6.2.1 Arbitrary file overwrite in node-tar before 7.5.10 lets a malicious tar archive write files outside the intend HIGH CVE-2026-30226 7.5 This Week devalue@2.0.1 In devalue v5.6.3, `devalue.parse` and `devalue.unflatten` were susceptible to prototype pollution via malicio HIGH CVE-2026-32141 7.5 This Week flatted@3.3.1 flatted is a circular JSON parser. versions up to 3.4.0 is affected by uncontrolled recursion (CVSS 7.5). HIGH CVE-2026-33228 8.9 This Week flatted@3.3.1 Prototype pollution in the flatted npm library (versions <= 3.4.1) lets an attacker who controls input to the HIGH CVE-2026-33671 7.5 This Week picomatch@2.3.1 picomatch, a widely-used Node.js glob pattern matching library, contains a Regular Expression Denial of Servic HIGH CVE-2026-33891 7.5 This Week node-forge@1.3.1 The node-forge cryptographic library for Node.js suffers from a complete Denial of Service condition when the HIGH CVE-2026-33894 7.5 This Week PoC node-forge@1.3.1 Signature forgery in node-forge npm package (all versions through v1.3.3) allows remote attackers to bypass RS HIGH CVE-2026-33895 7.5 This Week PoC node-forge@1.3.1 The digitalbazaar/forge npm package accepts forged Ed25519 signatures due to missing scalar canonicalization c HIGH CVE-2026-33938 8.1 This Week handlebars@4.7.7 Remote code execution in Handlebars templating engine (npm package) allows unauthenticated attackers to execut HIGH CVE-2026-33939 7.5 This Week handlebars@4.7.7 Handlebars.js template engine crashes Node.js processes when compiling templates containing unregistered decor HIGH CVE-2026-33940 8.1 This Week handlebars@4.7.7 Remote code execution in Handlebars templating engine (npm package) allows unauthenticated network attackers t HIGH CVE-2026-33941 8.2 This Week handlebars@4.7.7 The Handlebars npm package precompiler (bin/handlebars) allows arbitrary JavaScript injection through unsaniti HIGH CVE-2026-41907 8.1 This Week PoC uuid@10.0.0 Buffer overwrite vulnerability in uuid JavaScript library versions prior to 14.0.0 enables remote attackers to HIGH CVE-2026-42033 7.4 This Week PoC axios@0.26.1 Prototype pollution in Axios HTTP client versions before 1.15.1 and 0.31.1 enables silent interception and mod HIGH CVE-2026-42035 7.4 This Week PoC axios@0.26.1 Prototype pollution in Axios 1.x (prior to 1.15.1) and 0.x (prior to 0.31.1) enables HTTP header injection att HIGH CVE-2026-44289 7.5 This Week protobufjs@6.11.2 Remote denial of service in protobuf.js (npm package) allows unauthenticated attackers to crash Node.js proces HIGH CVE-2026-44290 7.5 This Week protobufjs@6.11.2 Prototype pollution in protobufjs allows denial of service through corrupted JavaScript built-ins when parsing HIGH CVE-2026-44291 8.1 This Week protobufjs@6.11.2 Prototype pollution in protobuf.js type lookup tables enables remote code execution via code injection into ge HIGH CVE-2026-44293 7.7 This Week protobufjs@6.11.2 Remote code execution in protobufjs (npm package) versions ≤7.5.5 and 8.0.0-8.0.1 allows attackers to inject a HIGH CVE-2026-44486 7.5 This Week axios@0.26.1 Proxy credential disclosure in Axios Node.js HTTP adapter (versions <1.16.0 and <=0.31.1) allows an attacker-c HIGH CVE-2026-44487 8.2 This Week axios@0.26.1 Proxy credential disclosure in Axios Node.js HTTP adapter (versions <1.16.0 and <=0.31.1) allows a malicious o HIGH CVE-2026-44488 7.5 This Week axios@1.13.2 Denial-of-service via size-limit bypass in Axios 1.7.0 through 1.15.x affects server-side Node.js applications HIGH CVE-2026-44490 8.2 This Week axios@0.26.1 Denial-of-service and HTTP header injection in the axios npm package (>=1.0.0,<1.16.0 and <=0.31.1) arise from HIGH CVE-2026-44492 8.6 This Week axios@0.26.1 Server-Side Request Forgery in axios versions <1.16.0 and <=0.31.1 allows remote attackers who control a reque HIGH CVE-2026-44494 8.7 This Week axios@1.13.2 Man-in-the-middle interception in the Axios HTTP client library (all versions through 1.15.x) allows any proto HIGH CVE-2026-44495 7.7 This Week axios@0.26.1 Credential theft and response hijacking is possible in Axios (npm) versions 1.0.0-1.15.1 and 0.19.0-0.30.x whe HIGH CVE-2026-44496 7.5 This Week axios@0.26.1 Client-side denial of service in Axios versions before 0.32.0 (0.x line) and before 1.16.0 (1.x line) allows a HIGH CVE-2026-44573 7.5 This Week PoC next@16.2.3 Middleware bypass in Next.js Pages Router applications allows unauthenticated access to protected server-side HIGH CVE-2026-44574 8.1 This Week next@16.2.3 Authorization bypass in Next.js 15.4.0-15.5.15 and 16.0.0-16.2.4 allows authenticated attackers to access prot HIGH CVE-2026-44575 7.5 This Week next@16.2.3 Authentication bypass in Next.js App Router allows unauthenticated remote attackers to access protected conten HIGH CVE-2026-44578 8.6 This Week PoC next@16.2.3 Server-side request forgery in Next.js allows remote unauthenticated attackers to proxy requests to arbitrary HIGH CVE-2026-44579 7.5 This Week next@16.2.3 Connection exhaustion denial of service affects Next.js applications using the Partial Prerendering feature wi HIGH CVE-2026-44705 7.7 This Week tmp@0.0.33 Path traversal in the tmp npm package (versions < 0.2.6) lets callers escape the intended temporary directory HIGH CVE-2026-44728 7.8 This Week @babel/plugin-transform-modules-systemjs@7.25.9 Arbitrary code generation in Babel's `@babel/plugin-transform-modules-systemjs` (and `@babel/preset-env` when HIGH CVE-2026-45109 7.5 This Week next@16.2.3 Middleware bypass in Next.js App Router applications using Turbopack allows remote unauthenticated attackers t HIGH CVE-2026-45149 7.5 This Week brace-expansion@5.0.4 Denial of service in brace-expansion versions 5.0.0 through 5.0.5 allows remote attackers to cause excessive r HIGH CVE-2026-45736 7.5 This Week ws@8.14.2 Uninitialized memory disclosure in the ws WebSocket library for Node.js (versions 8.0.0 through 8.20.0) allows HIGH CVE-2026-48068 7.5 This Week @grpc/grpc-js@0.8.1 Remote denial of service in @grpc/grpc-js (the official gRPC library for Node.js) allows unauthenticated netwo HIGH CVE-2026-48069 7.5 This Week @grpc/grpc-js@0.8.1 Denial of service in the @grpc/grpc-js Node.js library allows remote attackers to crash any client or server p HIGH CVE-2026-4867 7.5 This Week path-to-regexp@0.1.12 Catastrophic backtracking in path-to-regexp versions prior to 0.1.13 enables remote denial of service attacks HIGH CVE-2026-48712 7.5 This Week protobufjs@6.11.2 Denial of service in protobuf.js occurs when untrusted protobuf binary data containing deeply nested google.pr HIGH CVE-2026-48779 7.5 This Week PoC ws@7.5.3 Memory exhaustion denial of service in the npm 'ws' WebSocket library allows a remote unauthenticated peer to HIGH CVE-2026-48815 7.5 This Week PoC sigstore@4.0.0 Signature verification policy bypass in the sigstore npm package allows attackers to have unauthorized signing HIGH CVE-2026-4926 7.5 This Week path-to-regexp@8.3.0 The path-to-regexp library versions 8.0.0 through 8.3.0 suffer from catastrophic regular expression denial of HIGH CVE-2026-50272 7.5 This Week dd-trace@4.12.0 Remote unauthenticated Denial of Service in the Datadog dd-trace-js Node.js tracing library (versions < 5.100. HIGH CVE-2026-59869 7.5 This Week PoC js-yaml@3.14.1 Denial of service in js-yaml (a widely-used JavaScript YAML parser) 3.0.0-3.14.x and 4.0.0-4.2.x allows remote HIGH CVE-2026-59871 7.5 This Week PoC tar@6.2.1 Denial of service in node-tar prior to 7.5.18 allows unauthenticated network-reachable attackers to crash Node HIGH CVE-2026-59874 8.7 This Week PoC tar@6.2.1 Denial of service in node-tar prior to 7.5.18 allows remote attackers to hang a Node.js application by feeding HIGH CVE-2026-59877 7.5 This Week protobufjs@7.5.4 Denial-of-service via infinite loop in protobuf.js (the pure-JavaScript Protocol Buffers implementation for No HIGH CVE-2026-59879 8.7 This Week immutable@4.1.0 Denial of service in the Immutable.js JavaScript library (versions before 4.3.9 and 5.1.8) allows attackers wh HIGH CVE-2026-59880 8.7 This Week PoC immutable@4.1.0 Uncontrolled resource consumption in Immutable.js prior to 4.3.9 and 5.1.8 lets an attacker who controls keys HIGH CVE-2026-6321 7.5 This Week PoC fast-uri@3.0.2 Path normalization bypass in fast-uri 3.1.0 and earlier allows remote attackers to circumvent path-based acces HIGH CVE-2026-6322 7.5 This Week PoC fast-uri@3.0.2 Authority confusion in fast-uri JavaScript library allows remote attackers to bypass URL validation security c HIGH CVE-2026-64641 8.2 This Week next@16.2.3 Denial of service in Next.js App Router with Server Actions allows remote attackers to exhaust CPU resources a HIGH CVE-2026-64642 8.3 This Week next@16.2.3 Authentication bypass in Next.js App Router built with Turbopack when using a single i18n locale allows unauth HIGH CVE-2026-64645 8.3 This Week next@16.2.3 Server-Side Request Forgery (SSRF) and open redirect in Next.js rewrite/redirect rules when the destination ho HIGH CVE-2026-64649 8.3 This Week next@16.2.3 Server-Side Request Forgery in the Vercel Next.js framework (versions 14.1.1 through 15.5.20 and 16.0.0 throug HIGH CVE-2026-67213 8.2 This Week PoC nanoid@3.1.30 Denial-of-service in nanoid (Nano ID) versions before 5.1.6 lets an attacker hang a Node.js/JavaScript thread HIGH CVE-2026-67214 8.2 This Week PoC nanoid@3.1.30 Denial-of-service in the nanoid JavaScript library (versions before 5.1.16) lets an attacker hang a Node.js/br HIGH CVE-2026-69152 7.5 This Week PoC brace-expansion@1.1.11 Remote denial-of-service in the brace-expansion npm library (all active version lines prior to 1.1.18, 2.1.4, HIGH CVE-2026-69192 7.7 This Week PoC ip-address@10.1.0 Trust-boundary bypass in the ip-address npm library (all versions through 10.3.0) enables SSRF filter evasion HIGH CVE-2026-71476 8.7 This Week nx@22.2.3 Arbitrary file write via Zip-Slip in Nx's self-hosted HTTP remote cache extractor allows a malicious or MITM-p HIGH CVE-2026-73086 7.4 This Week PoC nanoid@3.1.30 Integer overflow in nanoid's size coercion path silently corrupts the process-wide CSPRNG pool, causing every HIGH CVE-2026-73088 7.5 This Week PoC browserslist@4.28.1 Prototype pollution and denial-of-service in Browserslist prior to 4.28.7 enable attackers to crash Node.js pr HIGH CVE-2026-73089 7.5 This Week PoC browserslist@4.28.1 Unbounded in-memory caches in Browserslist prior to 4.28.7 allow unauthenticated remote denial-of-service via HIGH CVE-2026-73566 7.5 This Week PoC tar@6.2.1 Stack-exhaustion denial-of-service in node-tar (npm package `tar`) versions up to and including 7.5.20 allows HIGH CVE-2026-73650 8.2 This Week PoC svgo@1.3.2 Cross-site scripting in SVGO's script-removal plugin exposes web applications that process untrusted SVG uploa HIGH CVE-2026-75975 7.5 This Week PoC fast-uri@3.0.2 Server-side request forgery and address-policy bypass in fast-uri, the Node.js URI parser used widely in the f HIGH CVE-2026-76172 7.5 This Week PoC fast-uri@3.0.2 Parsing and serialization inconsistency in fast-uri, the Node.js URI parser core to the Fastify ecosystem, all HIGH CVE-2026-84370 8.2 This Week svgo@1.3.2 Incomplete script filtering in SVGO's opt-in removeScripts plugin allows stored XSS to survive the sanitizatio HIGH CVE-2026-84375 7.5 This Week PoC js-yaml@3.14.1 Uncontrolled CPU consumption in js-yaml versions 3.0.0-3.15.1 and 4.0.0-4.3.1 allows unauthenticated remote at HIGH CVE-2026-85393 8.7 This Week node-forge@1.3.1 RSA PKCS#1 v1.5 signature forgery in node-forge through v1.4.0 enables unauthenticated network attackers to cr HIGH CVE-2026-9496 7.7 This Week pacote@21.0.1 Denial of service in npm's pacote package (versions 11.2.7 and later) allows remote unauthenticated attackers MEDIUM CVE-2017-16137 5.3 debug@4.1.1 The debug module is vulnerable to regular expression denial of service when untrusted user input is passed int MEDIUM CVE-2018-16487 5.6 PoC lodash@3.10.1 A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and def MEDIUM CVE-2018-3721 6.5 This Month PoC lodash@3.10.1 lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability vi MEDIUM CVE-2020-28498 6.8 elliptic@6.5.3 The package elliptic before 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in e MEDIUM CVE-2020-7608 5.3 This Month PoC yargs-parser@15.0.0 yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payl MEDIUM CVE-2020-7765 5.3 This Month PoC @firebase/util@0.2.47 This affects the package @firebase/util before 0.3.4. Rated medium severity (CVSS 5.3), this vulnerability is MEDIUM CVE-2021-23362 5.3 This Month PoC hosted-git-info@2.8.5 The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via re MEDIUM CVE-2022-33987 5.3 This Month got@3.3.1 The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket. Rated med MEDIUM CVE-2023-28155 6.1 This Month PoC request@2.88.2 The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller MEDIUM CVE-2023-45857 6.5 This Month PoC axios@0.26.1 An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by incl MEDIUM CVE-2024-11023 5.2 This Month firebase@7.14.5 Firebase JavaScript SDK utilizes a "FIREBASE_DEFAULTS" cookie to store configuration data, including an "_auth MEDIUM CVE-2024-11831 5.4 This Month serialize-javascript@6.0.1 A flaw was found in npm-serialize-javascript. Rated medium severity (CVSS 5.4), this vulnerability is remotely MEDIUM CVE-2024-24758 4.5 This Month undici@5.26.3 Undici is an HTTP/1.1 client, written from scratch for Node.js. Rated medium severity (CVSS 4.5), this vulnera MEDIUM CVE-2024-27088 5.5 This Month PoC es5-ext@0.10.53 es5-ext contains ECMAScript 5 extensions. Rated medium severity (CVSS 5.5), this vulnerability is low attack c MEDIUM CVE-2024-28849 6.5 This Month PoC follow-redirects@1.9.0 follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatical MEDIUM CVE-2024-29041 6.1 This Month express@4.17.0 Express.js minimalist web framework for node. Rated medium severity (CVSS 6.1), this vulnerability is remotely MEDIUM CVE-2024-30260 4.3 This Month undici@5.26.3 Undici is an HTTP/1.1 client, written from scratch for Node.js. Rated medium severity (CVSS 4.3), this vulnera MEDIUM CVE-2024-33883 4.0 This Month ejs@3.1.8 The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protecti MEDIUM CVE-2024-37168 5.3 This Month @grpc/grpc-js@0.8.1 @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Rated mediu MEDIUM CVE-2024-4067 5.3 This Month PoC micromatch@4.0.4 The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). Rat MEDIUM CVE-2024-42459 5.3 This Month PoC elliptic@6.5.3 In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing sign MEDIUM CVE-2024-42460 5.3 This Month PoC elliptic@6.5.3 In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing chec MEDIUM CVE-2024-43796 4.7 This Month express@4.17.0 Express.js minimalist web framework for node. Rated medium severity (CVSS 4.7), this vulnerability is remotely MEDIUM CVE-2024-43799 4.7 This Month send@0.17.1 Send is a library for streaming files from the file system as a http response. Rated medium severity (CVSS 4.7 MEDIUM CVE-2024-43800 4.7 This Month serve-static@1.14.1 serve-static serves static files. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable MEDIUM CVE-2024-47068 6.1 This Month PoC rollup@2.35.1 Rollup is a module bundler for JavaScript. Rated medium severity (CVSS 6.1), this vulnerability is remotely ex MEDIUM CVE-2024-47764 6.9 This Month cookie@0.4.0 cookie is a basic HTTP cookie parser and serializer for HTTP servers. Rated medium severity (CVSS 6.9), this v MEDIUM CVE-2024-48948 4.8 This Month PoC elliptic@6.5.3 The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signa MEDIUM CVE-2024-55565 4.3 This Month nanoid@3.1.30 nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. Rated medium severity (CVSS 4.3), this vulner MEDIUM CVE-2025-13465 6.9 This Month PoC lodash@3.10.1 Lodash versions up to 4.17.22 is affected by improperly controlled modification of object prototype attributes MEDIUM CVE-2025-13466 5.5 This Month body-parser@2.2.0 body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with ve MEDIUM CVE-2025-14505 5.6 This Month elliptic@6.5.3 The ECDSA implementation of the Elliptic package generates incorrect signatures if an interim value of 'k' (as MEDIUM CVE-2025-15599 6.1 This Month dompurify@3.1.5 DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows MEDIUM CVE-2025-22150 6.8 This Month undici@5.26.3 Undici is an HTTP/1.1 client. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, no MEDIUM CVE-2025-23207 6.3 This Month katex@0.16.10 KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. Rated medium severity (CVSS MEDIUM CVE-2025-25288 5.3 This Month @octokit/plugin-paginate-rest@8.0.0 @octokit/plugin-paginate-rest is the Octokit plugin to paginate REST API endpoint responses. Rated medium seve MEDIUM CVE-2025-25289 5.3 This Month @octokit/request-error@5.0.0 @octokit/request-error is an error class for Octokit request errors. Rated medium severity (CVSS 5.3), this vu MEDIUM CVE-2025-25290 5.3 This Month @octokit/request@8.1.1 @octokit/request sends parameterized requests to GitHub’s APIs with sensible defaults in browsers and Node. Ra MEDIUM CVE-2025-26791 4.5 This Month PoC dompurify@3.1.5 DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cro MEDIUM CVE-2025-30359 5.3 This Month PoC webpack-dev-server@5.2.0 A remote code execution vulnerability in webpack-dev-server (CVSS 5.3) that allows users. Risk factors: public MEDIUM CVE-2025-30360 6.5 This Month PoC webpack-dev-server@5.2.0 webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior t MEDIUM CVE-2025-32996 4.0 This Month http-proxy-middleware@2.0.7 In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is MEDIUM CVE-2025-32997 4.0 This Month http-proxy-middleware@2.0.7 In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has fai MEDIUM CVE-2025-54881 5.3 This Month mermaid@10.9.1 Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a MEDIUM CVE-2025-62718 6.3 This Month PoC axios@0.26.1 Hostname normalization bypass in Axios (JavaScript HTTP client) versions prior to 1.15.0 allows unauthenticate MEDIUM CVE-2025-64718 5.3 This Month js-yaml@3.14.1 js-yaml is a JavaScript YAML parser and dumper. Rated medium severity (CVSS 5.3), this vulnerability is remote MEDIUM CVE-2025-66030 6.3 This Month node-forge@1.3.1 Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Rated m MEDIUM CVE-2026-0540 5.3 This Month dompurify@3.1.5 DOMPurify versions 2.5.3-2.5.8 and 3.1.3-3.3.1 fail to sanitize attribute values within certain rawtext HTML e MEDIUM CVE-2026-12590 5.9 This Month PoC body-parser@1.19.0 Denial of service in body-parser npm middleware allows unauthenticated remote attackers to submit arbitrarily MEDIUM CVE-2026-14620 4.7 This Month PoC webpack-dev-server@5.2.0 Cross-site request forgery in webpack-dev-server 5.2.5 and earlier allows any website visited by a developer t MEDIUM CVE-2026-14631 5.3 This Month webpack-dev-server@5.2.0 webpack-dev-server 5.2.5 and earlier crash the entire Node.js host process when an unauthenticated remote peer MEDIUM CVE-2026-15157 5.4 This Month PoC undici@5.26.3 CRLF injection in undici's HTTP/1.1 dispatcher enables HTTP header injection and potential request smuggling w MEDIUM CVE-2026-1525 6.5 This Month undici@5.26.3 Undici fails to normalize HTTP header names when processing arrays, allowing duplicate Content-Length headers MEDIUM CVE-2026-1527 4.6 This Month undici@5.26.3 CRLF injection in undici's HTTP upgrade handling allows authenticated attackers to inject arbitrary headers an MEDIUM CVE-2026-16728 6.5 This Month PoC undici@5.26.3 Response body/Content-Length desynchronization in undici's retry interceptor allows a malicious or faulty upst MEDIUM CVE-2026-16729 6.5 This Month PoC undici@5.26.3 Cookie attribute injection in undici's setCookie function allows attacker-controlled domain values or unparsed MEDIUM CVE-2026-22036 5.9 This Month undici@5.26.3 Undici versions up to 7.18.0 is affected by allocation of resources without limits or throttling (CVSS 5.9). MEDIUM CVE-2026-23950 5.9 This Month PoC tar@6.2.1 Symlink poisoning via race condition in node-tar up to version 7.5.3 allows attackers to exploit Unicode norma MEDIUM CVE-2026-2581 5.9 This Month undici@7.22.0 Node.js Undici's response deduplication feature accumulates response bodies in memory instead of streaming the MEDIUM CVE-2026-2739 5.3 This Month bn.js@4.11.9 This affects versions of the package bn.j versions up to 5.2.3. is affected by loop with unreachable exit cond MEDIUM CVE-2026-2950 5.3 This Month lodash@3.10.1 Prototype pollution in Lodash 4.17.23 and earlier allows unauthenticated remote attackers to delete properties MEDIUM CVE-2026-31802 5.5 This Month tar@6.2.1 node-tar is a full-featured Tar for Node.js. MEDIUM CVE-2026-33532 4.3 This Month yaml@1.10.2 YAML parsing in Node.js and Apple products fails to enforce recursion depth limits, allowing an attacker to tr MEDIUM CVE-2026-33672 5.3 This Month picomatch@2.3.1 picomatch is vulnerable to a method injection vulnerability (CWE-1321) in its POSIX_REGEX_SOURCE object that a MEDIUM CVE-2026-33750 6.5 This Month brace-expansion@1.1.11 Brace-expansion library versions prior to 5.0.5 allow unauthenticated remote attackers to cause denial of serv MEDIUM CVE-2026-33916 4.7 This Month handlebars@4.7.7 Handlebars template engine fails to guard prototype-chain access when resolving partial templates, allowing un MEDIUM CVE-2026-34043 5.9 This Month serialize-javascript@6.0.1 The serialize-javascript npm library versions prior to 7.0.5 contain a CPU exhaustion denial-of-service vulner MEDIUM CVE-2026-40175 4.8 This Month axios@0.26.1 Remote code execution affects Axios HTTP client library versions prior to 1.15.0 via gadget chain escalation o MEDIUM CVE-2026-40895 6.9 This Month follow-redirects@1.15.9 Custom authentication header leakage in follow-redirects before 1.16.0 exposes API keys and session tokens whe MEDIUM CVE-2026-41148 5.3 This Month mermaid@10.9.1 CSS injection in Mermaid's diagram rendering engine (npm/mermaid v11.14.0 and earlier, v10.9.5 and earlier) al MEDIUM CVE-2026-41149 5.3 This Month mermaid@10.9.1 HTML injection in Mermaid's state diagram `classDef` parser allows escape from the SVG rendering context into MEDIUM CVE-2026-41150 5.3 This Month mermaid@10.9.1 Infinite-loop denial-of-service in Mermaid's Gantt chart renderer affects npm/mermaid v11.14.0 and earlier (in MEDIUM CVE-2026-41159 5.3 This Month mermaid@10.9.1 CSS scoping bypass in Mermaid's default configuration allows injected styles to escape the diagram SVG contain MEDIUM CVE-2026-41238 6.9 This Month dompurify@3.1.5 DOMPurify versions 3.0.1 through 3.3.3 fail to prevent prototype pollution-based XSS attacks when using defaul MEDIUM CVE-2026-41239 6.8 This Month dompurify@3.1.5 Cross-site scripting (XSS) in DOMPurify when using SAFE_FOR_TEMPLATES with RETURN_DOM or RETURN_DOM_FRAGMENT m MEDIUM CVE-2026-41240 6.0 This Month dompurify@3.1.5 Cross-site scripting (XSS) in DOMPurify occurs when function-based ADD_TAGS configuration is used with FORBID_ MEDIUM CVE-2026-42034 5.3 This Month PoC axios@0.26.1 Axios versions prior to 1.15.1 and 0.31.1 allow remote attackers to bypass maxBodyLength restrictions on strea MEDIUM CVE-2026-42036 5.3 This Month PoC axios@0.26.1 Axios HTTP client prior to version 1.15.1 (1.x branch) and 0.31.1 (0.x branch) fails to enforce maxContentLeng MEDIUM CVE-2026-42037 5.3 This Month PoC axios@1.13.2 Axios HTTP client versions 1.0.0 through 1.15.0 allow header injection in multipart form-data bodies through u MEDIUM CVE-2026-42038 6.8 This Month PoC axios@0.26.1 Axios versions prior to 1.15.1 and 0.31.1 fail to properly bypass proxy configurations when no_proxy=localhost MEDIUM CVE-2026-42039 6.9 This Month PoC axios@0.26.1 Denial of service in Axios HTTP client before versions 1.15.1 and 0.31.1 allows remote unauthenticated attacke MEDIUM CVE-2026-42041 6.5 This Month PoC axios@0.26.1 Prototype pollution in Axios library versions prior to 1.15.1 and 0.31.1 allows remote attackers to suppress H MEDIUM CVE-2026-42042 5.4 This Month PoC axios@0.26.1 Axios HTTP client versions prior to 1.15.1 and 0.31.1 use loose truthy/falsy comparison instead of strict bool MEDIUM CVE-2026-42338 5.3 This Month PoC ip-address@10.1.0 Cross-site scripting (XSS) vulnerabilities in ip-address library versions up to 10.1.0 allow attackers to inje MEDIUM CVE-2026-44288 5.3 This Month @protobufjs/utf8@1.1.0 protobufjs versions 7.5.5 and earlier, and 8.0.0-8.0.1 accept overlong UTF-8 byte sequences in the minimal UTF MEDIUM CVE-2026-44292 5.3 This Month protobufjs@6.11.2 Prototype injection in protobufjs generated message constructors allows attackers controlling plain objects pa MEDIUM CVE-2026-44294 5.3 This Month protobufjs@6.11.2 Denial of service in protobufjs allows remote attackers to crash runtime code generation by providing crafted MEDIUM CVE-2026-44576 5.4 This Month next@16.2.3 Cache poisoning in React Server Components allows remote attackers to serve malicious RSC payloads from legiti MEDIUM CVE-2026-44577 5.9 This Month next@16.2.3 Denial of service in Next.js Image Optimization API allows remote attackers to exhaust server memory by reques MEDIUM CVE-2026-44580 6.1 This Month next@16.2.3 Cross-site scripting in Next.js beforeInteractive scripts allows remote unauthenticated attackers to execute a MEDIUM CVE-2026-44581 4.7 This Month next@16.2.3 Cross-site scripting via CSP nonce poisoning in Next.js App Router allows attackers to inject malicious script MEDIUM CVE-2026-45740 5.3 This Month PoC protobufjs@6.11.2 Uncontrolled recursion in protobufjs versions prior to 7.5.8 and 8.2.0 allows remote attackers to exhaust the MEDIUM CVE-2026-45773 5.1 This Month PoC turbo@2.9.4 CSRF vulnerability in Turborepo's self-hosted authentication flow allows credential injection attacks when use MEDIUM CVE-2026-45819 6.6 This Month baseline-browser-mapping@2.9.19 Process termination in baseline-browser-mapping 2.x before 2.11.0 can be triggered by supplying invalid or con MEDIUM CVE-2026-45820 6.6 This Month PoC fflate@0.7.4 Denial of service in fflate through 0.8.2 exposes any application calling unzipSync() to an indefinite process MEDIUM CVE-2026-45822 6.6 This Month decode-uri-component@0.2.0 Super-linear algorithmic complexity in the decode-uri-component npm package (versions through 0.4.1) allows un MEDIUM CVE-2026-48038 5.3 This Month joi@17.13.3 Denial of service in the joi npm validation library (< 18.2.1) is triggered by submitting deeply nested JSON o MEDIUM CVE-2026-48758 5.4 This Month @sigstore/core@3.0.0 Signature type-binding bypass in @sigstore/core (npm) allows an attacker who controls the `payloadType` field MEDIUM CVE-2026-4923 5.9 This Month path-to-regexp@8.3.0 path-to-regexp versions prior to 8.4.0 are vulnerable to Regular Expression Denial of Service (ReDoS) when pro MEDIUM CVE-2026-49458 6.1 This Month dompurify@3.1.5 Cross-site scripting in DOMPurify ≤ 3.4.5 allows attackers to preserve executable markup through the library's MEDIUM CVE-2026-49459 6.1 This Month dompurify@3.1.5 Cross-site scripting in DOMPurify ≤ 3.4.5 allows attacker-controlled event handlers, javascript: URIs, and tem MEDIUM CVE-2026-49978 6.3 This Month dompurify@3.1.5 DOMPurify's HTML sanitizer silently skips shadow DOM contents nested inside <template> elements, allowing stor MEDIUM CVE-2026-50159 5.3 This Month mermaid@10.9.1 CSS injection in the Mermaid JavaScript diagramming library (npm) allows sibling CSS combinators (`~` and `+`) MEDIUM CVE-2026-53550 5.3 This Month js-yaml@3.14.1 Quadratic CPU exhaustion in js-yaml (npm) versions 4.1.1 and earlier allows unauthenticated remote attackers t MEDIUM CVE-2026-53632 5.5 This Month launch-editor@2.9.1 NTLMv2 hash disclosure in the `launch-editor` NPM package (v2.14.0 and earlier) exposes developer credentials MEDIUM CVE-2026-53655 6.9 This Month tar@6.2.1 Tar parser interpretation differential in node-tar (npm `tar` package) <= 7.5.15 allows a crafted archive to p MEDIUM CVE-2026-54269 5.3 This Month PoC protobufjs@6.11.2 Schema-name shadowing in protobufjs (npm packages protobufjs and protobufjs-cli) enables denial of service whe MEDIUM CVE-2026-54285 5.3 This Month @opentelemetry/core@1.15.2 Unbounded memory allocation in @opentelemetry/core affects the W3CBaggagePropagator.extract() method, which fa MEDIUM CVE-2026-54490 6.3 This Month websocket-driver@0.7.4 Resource limit bypass in the websocket-driver npm library (versions < 0.7.5) allows WebSocket messages to exce MEDIUM CVE-2026-54753 5.9 This Month nx@22.2.3 Cross-origin information disclosure in the Nx monorepo graph server (versions 17.0.4 through 22.7.1) exposes t MEDIUM CVE-2026-55602 6.9 This Month http-proxy-middleware@2.0.7 Backend routing bypass in http-proxy-middleware allows unauthenticated external attackers to redirect HTTP req MEDIUM CVE-2026-59875 5.3 This Month PoC tar@6.2.1 Process termination via crafted tar archive affects node-tar prior to 7.5.17, where NUL bytes in PAX path and MEDIUM CVE-2026-6402 5.3 This Month PoC webpack-dev-server@5.2.0 Cross-origin source code exposure in webpack-dev-server up to 5.2.3 allows attackers controlling a malicious w MEDIUM CVE-2026-64643 6.3 This Month next@16.2.3 Server Action endpoint IDs in Next.js App Router applications are exposed to unauthenticated users through pub MEDIUM CVE-2026-64644 6.3 This Month next@16.2.3 CPU exhaustion in the Next.js Image Optimization API allows unauthenticated remote attackers to deny service a MEDIUM CVE-2026-64646 6.3 This Month next@16.2.3 Unbounded Server Action payload processing in Next.js App Router exhausts server memory when the affected Serv MEDIUM CVE-2026-64647 6.3 This Month next@16.2.3 Cache key collision in Next.js server-side fetch exposes confidential POST response bodies to unintended calle MEDIUM CVE-2026-64648 6.0 This Month next@16.2.3 Cache confusion in Next.js App Router's server-side fetch patch leaks confidential POST response bodies across MEDIUM CVE-2026-65898 5.1 This Month PoC dompurify@3.1.5 Stored XSS is achievable in applications using DOMPurify's setConfig() API combined with an uponSanitizeAttrib MEDIUM CVE-2026-65899 5.1 This Month PoC dompurify@3.1.5 Trusted Types policy state contamination in DOMPurify 3.0.0-3.4.8 allows a previously supplied TRUSTED_TYPES_P MEDIUM CVE-2026-65900 5.1 This Month PoC dompurify@3.1.5 SAFE_FOR_TEMPLATES bypass in DOMPurify 3.0.0-3.4.7 allows template expressions such as ${evil}, {{evil}}, and MEDIUM CVE-2026-65901 5.1 This Month PoC dompurify@3.1.5 Cross-site scripting in DOMPurify 3.4.6 and earlier enables script execution when the library's IN_PLACE sanit MEDIUM CVE-2026-65902 5.3 This Month PoC dompurify@3.1.5 Hook mutation pollution in DOMPurify <= 3.4.5 allows persistent bypass of HTML sanitization defaults when appl MEDIUM CVE-2026-65903 5.1 This Month dompurify@3.1.5 DOMPurify versions up to and including 3.3.3 incorrectly resolves a tag-allow conflict when ADD_TAGS is used i MEDIUM CVE-2026-65912 5.1 This Month PoC dompurify@3.1.5 URI validation bypass in DOMPurify 3.3.1 and earlier allows `javascript:` protocol payloads to survive HTML sa MEDIUM CVE-2026-65913 5.1 This Month PoC dompurify@3.1.5 Prototype pollution in DOMPurify's USE_PROFILES mode enables DOM-based XSS by causing the sanitizer to accept MEDIUM CVE-2026-65914 5.3 This Month PoC dompurify@3.1.5 Mutation-XSS in DOMPurify before 3.3.2 enables JavaScript execution in victim browsers when sanitized output i MEDIUM CVE-2026-66010 5.1 This Month dompurify@3.1.5 DOMPurify before 3.4.12 fails to invoke the afterSanitizeElements hook for custom elements permitted via CUSTO MEDIUM CVE-2026-67312 6.3 This Month axios@1.13.2 Uncontrolled recursion in axios's formDataToJSON helper allows remote, unauthenticated attackers to exhaust th MEDIUM CVE-2026-67313 6.3 This Month PoC axios@1.13.2 Uncontrolled recursion in axios's formDataToJSON helper (versions 0.28.0 through <0.33.0 and 1.0.0 through <1. MEDIUM CVE-2026-67316 6.3 This Month axios@0.26.1 Read-side prototype pollution gadgets in axios allow a secondary attacker primitive to corrupt HTTP request se MEDIUM CVE-2026-67317 6.3 This Month axios@1.13.2 The fetch adapter in axios 1.7.0 through 1.17.x silently skips the maxBodyLength enforcement when a WHATWG Rea MEDIUM CVE-2026-67318 6.3 This Month axios@1.13.2 HTTP/2 streamed upload requests in axios 1.13.0-1.17.x bypass the configured maxBodyLength limit, allowing app MEDIUM CVE-2026-67319 6.3 This Month axios@0.26.1 Prototype pollution gadget in the axios npm HTTP client silently injects Authorization headers or tampers quer MEDIUM CVE-2026-71436 5.3 This Month PoC mermaid@10.9.1 Infinite-loop denial of service in Mermaid's XY chart renderer allows any party that can supply diagram input MEDIUM CVE-2026-75838 5.1 This Month dompurify@3.1.5 IN_PLACE sanitization bypass in DOMPurify before 3.4.13 enables persistent cross-site scripting after sanitize MEDIUM CVE-2026-81176 5.3 This Month devalue@2.0.1 Quadratic-complexity denial of service in the Svelte devalue JavaScript deserializer (all versions prior to 5. MEDIUM CVE-2026-82417 6.3 This Month PoC qs@6.11.0 The `qs.stringify` function in the qs Node.js query-string library throws an uncaught `TypeError` when seriali MEDIUM CVE-2026-84369 6.1 This Month svgo@1.3.2 Cross-site scripting in SVGO's opt-in removeScripts plugin allows XSS payloads embedded inside SVG foreignObje MEDIUM CVE-2026-85062 6.9 This Month colord@2.9.3 Synchronous CSS color string parsing in colord (npm, versions prior to 2.9.4) exposes Node.js applications to MEDIUM CVE-2026-8723 6.3 This Month qs@6.13.0 The qs Node.js library (versions 6.11.1 through 6.15.1) crashes with a synchronous TypeError when stringify is MEDIUM CVE-2026-9595 4.3 This Month webpack-dev-server@5.2.0 webpack-dev-server's WebSocket upgrade handler, when a proxy entry is configured with a broad path context (/) MEDIUM CVE-2026-9678 5.9 This Month undici@7.22.0 Cache information disclosure in Undici's shared-mode cache interceptor allows a prior authenticated user's HTT MEDIUM CVE-2026-9679 5.9 This Month undici@5.26.3 HTTP response header injection in undici's cookie parser exposes proxy, middleware, and SSR framework applicat LOW CVE-2024-30261 3.5 PoC undici@5.26.3 Undici is an HTTP/1.1 client, written from scratch for Node.js. Rated low severity (CVSS 3.5), this vulnerabil LOW CVE-2025-47279 3.1 undici@5.26.3 Undici is an HTTP/1.1 client for Node.js. Rated low severity (CVSS 3.1), this vulnerability is remotely exploi LOW CVE-2025-54798 2.5 PoC tmp@0.0.33 tmp is a temporary file and directory creator for node.js. Rated low severity (CVSS 2.5). Public exploit code LOW CVE-2025-5889 1.3 brace-expansion@1.1.11 Inefficient regular expression complexity in brace-expansion up to versions 1.1.11/2.0.1/3.0.0/4.0.0 allows re LOW CVE-2025-68157 3.7 PoC webpack@5.98.0 Webpack is a module bundler. From version 5.49.0 to before 5.104.0, when experiments.buildHttp is enabled, web LOW CVE-2025-68458 3.7 PoC webpack@5.98.0 Webpack is a module bundler. From version 5.49.0 to before 5.104.1, when experiments.buildHttp is enabled, web LOW CVE-2025-69873 2.9 PoC ajv@6.12.6 ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS LOW CVE-2026-11525 3.7 undici@5.26.3 SameSite attribute parsing in undici's cookie implementation uses substring matching instead of the case-insen LOW CVE-2026-2391 3.7 PoC qs@6.11.0 ### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true LOW CVE-2026-24001 2.7 diff@5.1.0 Denial-of-service in jsdiff versions prior to 8.0.3, 5.2.2, 4.0.4, and 3.5.1 allows unauthenticated remote att LOW CVE-2026-3449 1.9 @tootallnate/once@2.0.0 Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in pro LOW CVE-2026-41988 2.5 uuid@10.0.0 UUID library versions before 14.0.0 make unexpected writes to external output buffers when generating UUID ver LOW CVE-2026-42040 3.7 PoC axios@0.26.1 Axios versions prior to 1.15.1 and 0.31.1 contain a character mapping flaw in the AxiosURLSearchParams.encode( LOW CVE-2026-44572 3.7 next@16.2.3 Cache poisoning in Next.js middleware redirect handling allows attackers to inject a malicious x-nextjs-data r LOW CVE-2026-44582 3.7 next@16.2.3 Cache poisoning in Next.js React Server Component responses allows attackers to poison shared cache entries th LOW CVE-2026-49356 3.6 @babel/core@7.26.10 Arbitrary source map file read in @babel/core allows an attacker who controls Babel's input source code to exf LOW CVE-2026-6733 3.7 undici@5.26.3 Response queue poisoning in Undici's HTTP/1.1 client allows an attacker-controlled or compromised upstream ser LOW CVE-2026-71438 2.4 PoC mermaid@10.9.1 Prototype pollution in the Mermaid JavaScript diagramming library (npm/mermaid) exposes applications to JavaSc LOW CVE-2026-84367 3.7 joi@17.13.3 Limited prototype pollution in joi's object().rename() allows unauthenticated remote attackers to set the prot LOW CVE-2026-84368 3.7 joi@17.13.3 Prototype pollution in joi, one of the most widely used JavaScript schema-validation libraries (versions 16.0. LOW CVE-2026-8769 2.1 @ai-sdk/provider-utils@2.2.8 Resource exhaustion in Vercel AI SDK's provider-utils package (versions ≤3.0.97) allows authenticated remote a LOW CVE-2026-9358 2.1 PoC postcss-selector-parser@6.1.2 Uncontrolled recursion in PostCSS up to 7.1.1 allows remote attackers to trigger denial of service via crafted N/A CVE-2021-23566 nanoid@3.1.30 Vulnerability in nanoid N/A CVE-2022-0155 follow-redirects@1.9.0 Vulnerability in follow-redirects N/A CVE-2022-0235 node-fetch@1.7.3 Vulnerability in node-fetch N/A CVE-2022-0536 follow-redirects@1.9.0 Vulnerability in follow-redirects N/A CVE-2025-15284 qs@6.11.0 Vulnerability in qs, qs, qs, qs, qs N/A CVE-2025-7339 on-headers@1.0.2 Vulnerability in on-headers N/A CVE-2025-7783 form-data@2.3.3 Vulnerability in form-data, form-data, form-data N/A CVE-2026-45772 turbo@2.9.4 Turborepo is a high-performance build system for JavaScript and TypeScript codebases. From 1.1.0 to before 2.9 Show 337 more CVEs Show less

CRITICAL CVE-2023-26136 9.8 Act Now PoC tough-cookie@2.5.0 Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handli CRITICAL CVE-2023-37466 10.0 Act Now PoC vm2@3.9.19 vm2 is an advanced vm/sandbox for Node.js. Rated critical severity (CVSS 10.0), this vulnerability is remotely CRITICAL CVE-2023-37903 10.0 Act Now vm2@3.9.19 vm2 is an open source vm/sandbox for Node.js. Rated critical severity (CVSS 10.0), this vulnerability is remot CRITICAL CVE-2023-42282 9.8 PoC ip@1.1.8 The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improp CRITICAL CVE-2025-6545 9.1 Act Now pbkdf2@3.1.2 CVE-2025-6545 is an improper input validation vulnerability in the pbkdf2 library (versions 3.0.10 through 3.1 CRITICAL CVE-2025-6547 9.1 Act Now pbkdf2@3.1.2 CVE-2025-6547 is an improper input validation vulnerability in the pbkdf2 cryptographic library (versions ≤3.1 CRITICAL CVE-2025-9287 9.1 Act Now PoC cipher-base@1.0.4 Improper Input Validation vulnerability in cipher-base allows Input Data Manipulation.0.4. Rated critical seve CRITICAL CVE-2025-9288 9.1 Act Now PoC sha.js@2.4.11 Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.js: through 2.4.11. Rated cri CRITICAL CVE-2026-22709 9.8 Act Now PoC vm2@3.9.19 Sandbox escape in vm2 Node.js sandbox before 3.10.2 via Promise.prototype.then/catch callback sanitization byp CRITICAL CVE-2026-24118 9.8 Act Now PoC vm2@3.9.19 Remote code execution in VM2 sandbox (npm package) versions ≤3.10.4 allows attackers to escape the JavaScript CRITICAL CVE-2026-24120 9.8 Act Now PoC vm2@3.9.19 Sandbox escape in vm2 for Node.js allows remote unauthenticated attackers to execute arbitrary commands on the CRITICAL CVE-2026-24781 9.8 Act Now vm2@3.9.19 Remote code execution in vm2 (Node.js sandbox library) versions prior to 3.11.0 allows unauthenticated attacke CRITICAL CVE-2026-26332 10.0 Act Now vm2@3.9.19 Sandbox escape leading to remote code execution in the vm2 Node.js sandbox library affects all versions prior CRITICAL CVE-2026-26956 9.8 Act Now PoC vm2@3.9.19 Full sandbox escape with arbitrary code execution allows remote attackers to break out of vm2's Node.js sandbo CRITICAL CVE-2026-27699 9.1 Act Now PoC basic-ftp@5.0.4 Path traversal in basic-ftp Node.js FTP client library before 5.2.0 allows malicious FTP servers to write file CRITICAL CVE-2026-33896 9.1 Act Now PoC node-forge@1.3.3 Certificate chain spoofing in node-forge (npm) <= 1.3.3 lets an attacker present any non-CA leaf certificate a CRITICAL CVE-2026-33937 9.8 Act Now handlebars@4.7.8 Remote code execution in Handlebars.js npm package allows unauthenticated attackers to execute arbitrary JavaS CRITICAL CVE-2026-43997 10.0 Act Now vm2@3.9.19 Remote code execution in vm2 Node.js sandbox library (versions ≤3.10.5) allows attackers to escape isolation a CRITICAL CVE-2026-44005 10.0 Act Now vm2@3.9.19 vm2 npm package versions 3.9.6 through 3.10.5 allow sandbox escape through prototype pollution of host-realm i CRITICAL CVE-2026-44006 10.0 Act Now vm2@3.9.19 Prototype chain manipulation in vm2 Node.js sandbox library enables complete sandbox escape and remote code ex CRITICAL CVE-2026-44007 9.1 Act Now vm2@3.9.19 vm2 NodeVM with nesting:true silently overrides require:false, granting sandbox code unconditional access to r CRITICAL CVE-2026-44008 9.8 Act Now vm2@3.9.19 Remote code execution in vm2 npm package (versions ≤3.11.1) allows attackers to escape the JavaScript sandbox CRITICAL CVE-2026-44009 9.8 Act Now vm2@3.9.19 Remote code execution in VM2 (npm package) allows complete sandbox escape via null-prototype exception handlin CRITICAL CVE-2026-45411 9.8 Act Now PoC vm2@3.9.19 Sandbox escape in vm2 (patriksimek/vm2) versions prior to 3.11.3 enables remote code execution on the host Nod CRITICAL CVE-2026-47131 10.0 Act Now vm2@3.9.19 Sandbox escape in the vm2 Node.js sandbox library (versions <= 3.11.3) allows untrusted JavaScript executed in CRITICAL CVE-2026-47137 10.0 Act Now vm2@3.9.19 Sandbox escape in vm2 (npm package, versions <= 3.11.3) allows full remote code execution by bypassing the GHS CRITICAL CVE-2026-47140 10.0 Act Now vm2@3.9.19 Sandbox escape leading to remote code execution in vm2 NodeVM versions 3.11.3 and earlier allows attackers run CRITICAL CVE-2026-47208 10.0 Act Now vm2@3.9.19 Remote code execution in the vm2 Node.js sandbox library (versions <= 3.11.3) allows sandboxed JavaScript to e CRITICAL CVE-2026-47210 9.8 Act Now vm2@3.9.19 Sandbox escape in vm2 (npm package, versions <= 3.11.3) allows arbitrary code execution in the Node.js host pr CRITICAL CVE-2026-47686 9.9 Act Now PoC vm2@3.9.19 Sandbox escape to remote code execution in the vm2 Node.js sandbox library (versions <= 3.11.5) arises because CRITICAL CVE-2026-47698 9.8 Act Now PoC vm2@3.9.19 Sandbox escape in the vm2 Node.js sandboxing library (npm, versions <= 3.11.5) lets code running inside the sa CRITICAL CVE-2026-4800 9.8 Act Now PoC lodash@4.17.21 Server-side code injection in Lodash's _.template function (lodash, lodash-es, lodash-amd and lodash.template, CRITICAL CVE-2026-53486 9.1 Act Now decompress@4.2.1 Arbitrary file read and write via archive extraction in the Node.js @xhmikosr/decompress library (and the unma CRITICAL CVE-2026-59873 9.2 Act Now PoC tar@2.2.2 Uncontrolled resource consumption in node-tar before 7.5.19 lets a small crafted gzip bomb exhaust disk space CRITICAL CVE-2026-92960 10.0 Act Now vm2@3.9.19 Sandboxed JavaScript executed inside vm2's NodeVM before 3.11.6 can step outside the isolation boundary to rea HIGH CVE-2021-23337 7.2 This Week PoC lodash@4.17.21 Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. Rated high sev HIGH CVE-2021-32804 8.1 Act Now tar@2.2.2 The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Crea HIGH CVE-2021-37713 8.6 This Week tar@2.2.2 The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/ HIGH CVE-2021-3795 7.5 This Week PoC semver-regex@2.0.0 semver-regex is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this HIGH CVE-2021-43307 7.5 PoC semver-regex@2.0.0 An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, HIGH CVE-2022-24434 7.5 This Week PoC dicer@0.2.5 This affects all versions of package dicer. Rated high severity (CVSS 7.5), this vulnerability is remotely exp HIGH CVE-2022-25881 7.5 PoC http-cache-semantics@3.8.1 This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicio HIGH CVE-2022-25883 7.5 PoC semver@5.7.1 Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via HIGH CVE-2023-45133 8.8 This Week babel-traverse@6.26.0 Babel is a compiler for writingJavaScript. Rated high severity (CVSS 8.8), this vulnerability is low attack co HIGH CVE-2023-46234 7.5 This Week browserify-sign@4.2.1 browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of thi HIGH CVE-2024-21538 7.7 This Week cross-spawn@5.1.0 Alpine Linux: npm fixed in 10.9.1-r0 HIGH CVE-2024-29415 8.1 This Week ip@1.1.8 The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 0120003456 HIGH CVE-2024-37890 7.5 This Week ws@7.5.7 ws is an open source WebSocket client and server for Node.js. Rated high severity (CVSS 7.5), this vulnerabili HIGH CVE-2024-4068 7.5 This Week PoC braces@2.3.2 The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, whic HIGH CVE-2024-45296 7.5 This Week path-to-regexp@0.1.10 path-to-regexp turns path strings into a regular expressions. Rated high severity (CVSS 7.5), this vulnerabili HIGH CVE-2024-52798 7.7 This Week path-to-regexp@0.1.10 path-to-regexp turns path strings into a regular expressions. Rated high severity (CVSS 7.7), this vulnerabili HIGH CVE-2025-47935 7.5 This Month multer@1.4.4 Multer is a node.js middleware for handling `multipart/form-data`. Rated high severity (CVSS 7.5), this vulner HIGH CVE-2025-47944 7.5 This Month multer@1.4.4 Multer is a node.js middleware for handling `multipart/form-data`. Rated high severity (CVSS 7.5), this vulner HIGH CVE-2025-48997 8.7 This Week multer@1.4.4 Denial of Service vulnerability in Multer (Node.js multipart form-data middleware) affecting versions 1.4.4-lt HIGH CVE-2025-64756 7.5 This Month PoC glob@10.4.5 Glob matches files using patterns the shell uses. Rated high severity (CVSS 7.5), this vulnerability is remote HIGH CVE-2026-12143 8.7 This Week form-data@2.3.3 CRLF injection in the form-data Node.js library (versions through 4.0.5) allows remote attackers to inject arb HIGH CVE-2026-13149 7.7 This Week PoC brace-expansion@1.1.11 Denial of service in the npm brace-expansion library through version 5.0.6 allows unauthenticated remote attac HIGH CVE-2026-14257 7.5 This Week PoC brace-expansion@1.1.11 Denial of service in the brace-expansion Node.js library (through version 5.0.7) lets remote attackers crash a HIGH CVE-2026-19693 8.1 extract-zip@2.0.1 Arbitrary file write outside the extraction destination is possible in extract-zip 2.0.1 and earlier due to an HIGH CVE-2026-2359 8.7 This Week multer@1.4.4 Denial of service in Multer (Express.js multipart/form-data middleware) before version 2.1.0 lets remote unaut HIGH CVE-2026-23745 8.2 This Week PoC tar@2.2.2 Arbitrary file overwrite and symlink poisoning in the node-tar library (versions <= 7.5.2) lets a malicious ta HIGH CVE-2026-24842 8.2 This Week PoC tar@2.2.2 node-tar before version 7.5.7 contains a path traversal vulnerability where inconsistent path resolution betwe HIGH CVE-2026-26960 7.1 This Week PoC tar@2.2.2 Path traversal in node-tar versions 7.5.7 and earlier allows local attackers to read and write arbitrary files HIGH CVE-2026-26996 7.5 This Week PoC minimatch@3.1.2 Minimatch versions 10.2.0 and below suffer from catastrophic backtracking in regular expression processing whe HIGH CVE-2026-27606 8.8 This Week PoC rollup@2.79.1 Arbitrary file write via path traversal in the Rollup JavaScript module bundler lets an attacker who can influ HIGH CVE-2026-27903 7.5 This Week PoC minimatch@3.1.2 Minimatch versions before 3.1.3 through 10.2.3 suffer from catastrophic backtracking in glob pattern matching HIGH CVE-2026-27904 7.5 This Week PoC minimatch@3.1.2 Minimatch versions prior to 10.2.3 (and earlier affected versions) suffer from ReDoS vulnerabilities in nested HIGH CVE-2026-29786 8.2 This Week PoC tar@2.2.2 Arbitrary file overwrite in node-tar before 7.5.10 lets a malicious tar archive write files outside the intend HIGH CVE-2026-32141 7.5 This Week flatted@3.2.5 flatted is a circular JSON parser. versions up to 3.4.0 is affected by uncontrolled recursion (CVSS 7.5). HIGH CVE-2026-3304 8.7 This Week multer@1.4.4 Denial of service in Multer (the Express/Node.js multipart/form-data middleware) before version 2.1.0 lets rem HIGH CVE-2026-33151 8.7 This Week socket.io-parser@4.2.4 A specially crafted Socket.IO packet can cause the server to allocate unbounded memory by waiting for and buff HIGH CVE-2026-33228 8.9 This Week flatted@3.2.5 Prototype pollution in the flatted npm library (versions <= 3.4.1) lets an attacker who controls input to the HIGH CVE-2026-33671 7.5 This Week picomatch@2.3.1 picomatch, a widely-used Node.js glob pattern matching library, contains a Regular Expression Denial of Servic HIGH CVE-2026-33891 7.5 This Week node-forge@1.3.3 The node-forge cryptographic library for Node.js suffers from a complete Denial of Service condition when the HIGH CVE-2026-33894 7.5 This Week PoC node-forge@1.3.3 Signature forgery in node-forge npm package (all versions through v1.3.3) allows remote attackers to bypass RS HIGH CVE-2026-33895 7.5 This Week PoC node-forge@1.3.3 The digitalbazaar/forge npm package accepts forged Ed25519 signatures due to missing scalar canonicalization c HIGH CVE-2026-33938 8.1 This Week handlebars@4.7.8 Remote code execution in Handlebars templating engine (npm package) allows unauthenticated attackers to execut HIGH CVE-2026-33939 7.5 This Week handlebars@4.7.8 Handlebars.js template engine crashes Node.js processes when compiling templates containing unregistered decor HIGH CVE-2026-33940 8.1 This Week handlebars@4.7.8 Remote code execution in Handlebars templating engine (npm package) allows unauthenticated network attackers t HIGH CVE-2026-33941 8.2 This Week handlebars@4.7.8 The Handlebars npm package precompiler (bin/handlebars) allows arbitrary JavaScript injection through unsaniti HIGH CVE-2026-3520 8.7 This Week multer@1.4.4 Denial of service in Multer (Express.js multipart/form-data middleware) before version 2.1.1 allows remote una HIGH CVE-2026-41324 7.5 This Week basic-ftp@5.0.4 Denial of service in basic-ftp for Node.js allows remote malicious FTP servers to crash client applications vi HIGH CVE-2026-41907 8.1 This Week PoC uuid@3.4.0 Buffer overwrite vulnerability in uuid JavaScript library versions prior to 14.0.0 enables remote attackers to HIGH CVE-2026-44001 8.6 This Week vm2@3.9.19 Remote unauthenticated attackers can crash Node.js processes running vm2 <= 3.10.5 by triggering an unhandled HIGH CVE-2026-44004 7.5 This Week vm2@3.9.19 Denial-of-service in vm2 Node.js sandbox allows unauthenticated remote attackers to crash host processes via u HIGH CVE-2026-44240 7.5 This Week basic-ftp@5.0.4 Remote unauthenticated attackers can trigger memory exhaustion and process-level denial of service in Node.js HIGH CVE-2026-44705 7.7 This Week tmp@0.0.33 Path traversal in the tmp npm package (versions < 0.2.6) lets callers escape the intended temporary directory HIGH CVE-2026-44728 7.8 This Week @babel/plugin-transform-modules-systemjs@7.23.9 Arbitrary code generation in Babel's `@babel/plugin-transform-modules-systemjs` (and `@babel/preset-env` when HIGH CVE-2026-45736 7.5 This Week ws@8.17.1 Uninitialized memory disclosure in the ws WebSocket library for Node.js (versions 8.0.0 through 8.20.0) allows HIGH CVE-2026-47135 8.7 This Week vm2@3.9.19 Sandbox escape in vm2 versions 3.11.2 and earlier (through 3.11.3) allows sandboxed JavaScript to obtain real HIGH CVE-2026-47139 8.6 This Week vm2@3.9.19 Sandbox network isolation bypass in vm2 NodeVM (versions <= 3.11.3) allows untrusted JavaScript running in the HIGH CVE-2026-47209 8.6 This Week vm2@3.9.19 Sandbox escape in vm2 (npm) versions ≤ 3.11.3 allows untrusted code running inside the VM to write arbitrary p HIGH CVE-2026-47683 8.7 This Week PoC vm2@3.9.19 Denial-of-service in vm2 (Node.js sandbox library) versions 3.11.0-3.11.5 allows sandbox code to bypass the `b HIGH CVE-2026-4867 7.5 This Week path-to-regexp@0.1.10 Catastrophic backtracking in path-to-regexp versions prior to 0.1.13 enables remote denial of service attacks HIGH CVE-2026-48779 7.5 This Week PoC ws@7.5.7 Memory exhaustion denial of service in the npm 'ws' WebSocket library allows a remote unauthenticated peer to HIGH CVE-2026-48815 7.5 This Week PoC sigstore@3.1.0 Signature verification policy bypass in the sigstore npm package allows attackers to have unauthorized signing HIGH CVE-2026-5079 7.5 This Week multer@1.4.4 Denial of service in the Express.js multer middleware (versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1) allows HIGH CVE-2026-56876 8.6 extract-zip@2.0.1 Arbitrary file read/write in the Node.js extract-zip library (max-mapper/extract-zip) arises because symlink e HIGH CVE-2026-59724 7.5 This Week engine.io@6.6.2 Denial of service in Engine.IO 6.5.0 through 6.6.6 (the transport layer beneath Socket.IO) lets remote unauthe HIGH CVE-2026-59725 7.5 This Week engine.io@6.6.2 Denial of service in Socket.IO (Engine.IO server) from 4.1.0 before 6.6.7 lets a remote unauthenticated attack HIGH CVE-2026-59869 7.5 This Week PoC js-yaml@3.14.2 Denial of service in js-yaml (a widely-used JavaScript YAML parser) 3.0.0-3.14.x and 4.0.0-4.2.x allows remote HIGH CVE-2026-59871 7.5 This Week PoC tar@2.2.2 Denial of service in node-tar prior to 7.5.18 allows unauthenticated network-reachable attackers to crash Node HIGH CVE-2026-59874 8.7 This Week PoC tar@2.2.2 Denial of service in node-tar prior to 7.5.18 allows remote attackers to hang a Node.js application by feeding HIGH CVE-2026-69152 7.5 This Week PoC brace-expansion@1.1.11 Remote denial-of-service in the brace-expansion npm library (all active version lines prior to 1.1.18, 2.1.4, HIGH CVE-2026-69185 7.5 This Week PoC socket.io-parser@4.2.4 Memory exhaustion via malformed binary attachment packets in the socket.io-parser npm library allows unauthent HIGH CVE-2026-69192 7.7 This Week PoC ip-address@10.0.1 Trust-boundary bypass in the ip-address npm library (all versions through 10.3.0) enables SSRF filter evasion HIGH CVE-2026-73088 7.5 This Week PoC browserslist@4.23.0 Prototype pollution and denial-of-service in Browserslist prior to 4.28.7 enable attackers to crash Node.js pr HIGH CVE-2026-73089 7.5 This Week PoC browserslist@4.23.0 Unbounded in-memory caches in Browserslist prior to 4.28.7 allow unauthenticated remote denial-of-service via HIGH CVE-2026-73566 7.5 This Week PoC tar@2.2.2 Stack-exhaustion denial-of-service in node-tar (npm package `tar`) versions up to and including 7.5.20 allows HIGH CVE-2026-77078 7.5 This Week multer@1.4.4 Remote denial-of-service in the Node.js multer middleware (all versions before 2.3.0) allows unauthenticated a HIGH CVE-2026-82333 7.5 This Week multer@1.4.4 Event loop exhaustion in multer (all versions before 2.3.0) allows unauthenticated remote attackers to render HIGH CVE-2026-84375 7.5 This Week PoC js-yaml@3.14.2 Uncontrolled CPU consumption in js-yaml versions 3.0.0-3.15.1 and 4.0.0-4.3.1 allows unauthenticated remote at HIGH CVE-2026-85393 8.7 This Week node-forge@1.3.3 RSA PKCS#1 v1.5 signature forgery in node-forge through v1.4.0 enables unauthenticated network attackers to cr HIGH CVE-2026-92961 8.7 This Week vm2@3.9.19 Memory exhaustion denial of service in vm2 through 3.11.5 lets sandboxed JavaScript escalate beyond the operat HIGH CVE-2026-9496 7.7 This Week pacote@20.0.0 Denial of service in npm's pacote package (versions 11.2.7 and later) allows remote unauthenticated attackers MEDIUM CVE-2020-15366 5.6 This Month ajv@5.5.2 An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. Rated medium seve MEDIUM CVE-2022-33987 5.3 This Month got@11.8.3 The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket. Rated med MEDIUM CVE-2023-28155 6.1 This Month PoC request@2.88.2 The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller MEDIUM CVE-2024-11831 5.4 This Month serialize-javascript@6.0.0 A flaw was found in npm-serialize-javascript. Rated medium severity (CVSS 5.4), this vulnerability is remotely MEDIUM CVE-2024-27088 5.5 This Month PoC es5-ext@0.10.61 es5-ext contains ECMAScript 5 extensions. Rated medium severity (CVSS 5.5), this vulnerability is low attack c MEDIUM CVE-2024-28863 6.5 This Month PoC tar@2.2.2 node-tar is a Tar for Node.js. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, n MEDIUM CVE-2024-4067 5.3 This Month PoC micromatch@3.1.10 The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). Rat MEDIUM CVE-2024-47068 6.1 This Month PoC rollup@2.79.1 Rollup is a module bundler for JavaScript. Rated medium severity (CVSS 6.1), this vulnerability is remotely ex MEDIUM CVE-2025-13465 6.9 This Month PoC lodash@4.17.21 Lodash versions up to 4.17.22 is affected by improperly controlled modification of object prototype attributes MEDIUM CVE-2025-14505 5.6 This Month elliptic@6.6.0 The ECDSA implementation of the Elliptic package generates incorrect signatures if an interim value of 'k' (as MEDIUM CVE-2025-25288 5.3 This Month @octokit/plugin-paginate-rest@6.1.2 @octokit/plugin-paginate-rest is the Octokit plugin to paginate REST API endpoint responses. Rated medium seve MEDIUM CVE-2025-25289 5.3 This Month @octokit/request-error@3.0.3 @octokit/request-error is an error class for Octokit request errors. Rated medium severity (CVSS 5.3), this vu MEDIUM CVE-2025-25290 5.3 This Month @octokit/request@6.2.8 @octokit/request sends parameterized requests to GitHub’s APIs with sensible defaults in browsers and Node. Ra MEDIUM CVE-2025-27789 6.2 This Month PoC @babel/helpers@7.23.9 Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and MEDIUM CVE-2025-64718 5.3 This Month js-yaml@4.1.0 js-yaml is a JavaScript YAML parser and dumper. Rated medium severity (CVSS 5.3), this vulnerability is remote MEDIUM CVE-2026-10732 5.6 This Month decompress@4.2.1 Arbitrary file write in the npm decompress package (all versions) exploits a second-generation Zip Slip bypass MEDIUM CVE-2026-12590 5.9 This Month PoC body-parser@1.20.3 Denial of service in body-parser npm middleware allows unauthenticated remote attackers to submit arbitrarily MEDIUM CVE-2026-23950 5.9 This Month PoC tar@2.2.2 Symlink poisoning via race condition in node-tar up to version 7.5.3 allows attackers to exploit Unicode norma MEDIUM CVE-2026-2739 5.3 This Month bn.js@4.12.0 This affects versions of the package bn.j versions up to 5.2.3. is affected by loop with unreachable exit cond MEDIUM CVE-2026-2950 5.3 This Month lodash@4.17.21 Prototype pollution in Lodash 4.17.23 and earlier allows unauthenticated remote attackers to delete properties MEDIUM CVE-2026-31802 5.5 This Month tar@2.2.2 node-tar is a full-featured Tar for Node.js. MEDIUM CVE-2026-33672 5.3 This Month picomatch@2.3.1 picomatch is vulnerable to a method injection vulnerability (CWE-1321) in its POSIX_REGEX_SOURCE object that a MEDIUM CVE-2026-33750 6.5 This Month brace-expansion@1.1.11 Brace-expansion library versions prior to 5.0.5 allow unauthenticated remote attackers to cause denial of serv MEDIUM CVE-2026-33916 4.7 This Month handlebars@4.7.8 Handlebars template engine fails to guard prototype-chain access when resolving partial templates, allowing un MEDIUM CVE-2026-34043 5.9 This Month serialize-javascript@6.0.0 The serialize-javascript npm library versions prior to 7.0.5 contain a CPU exhaustion denial-of-service vulner MEDIUM CVE-2026-39243 5.5 This Month decompress@4.2.1 Arbitrary hardlink creation in the decompress npm package (before version 4.2.2) enables read disclosure and o MEDIUM CVE-2026-40895 6.9 This Month follow-redirects@1.15.11 Custom authentication header leakage in follow-redirects before 1.16.0 exposes API keys and session tokens whe MEDIUM CVE-2026-42338 5.3 This Month PoC ip-address@10.0.1 Cross-site scripting (XSS) vulnerabilities in ip-address library versions up to 10.1.0 allow attackers to inje MEDIUM CVE-2026-44000 6.5 This Month vm2@3.9.19 Host object identity crosses the vm2 sandbox boundary when Promise resolution delivers objects to sandbox call MEDIUM CVE-2026-44002 5.8 This Month vm2@3.9.19 Information disclosure in vm2 allows sandboxed code to extract host absolute file paths, library locations, an MEDIUM CVE-2026-44003 5.3 This Month vm2@3.9.19 Security control bypass in vm2 sandbox allows direct access to internal VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGR MEDIUM CVE-2026-45822 6.6 This Month decode-uri-component@0.2.2 Super-linear algorithmic complexity in the decode-uri-component npm package (versions through 0.4.1) allows un MEDIUM CVE-2026-47141 6.9 This Month vm2@3.9.19 Host process data leakage in vm2 (npm/vm2 <= 3.11.3) allows untrusted JavaScript executing inside a NodeVM san MEDIUM CVE-2026-48758 5.4 This Month @sigstore/core@2.0.0 Signature type-binding bypass in @sigstore/core (npm) allows an attacker who controls the `payloadType` field MEDIUM CVE-2026-53550 5.3 This Month js-yaml@3.14.2 Quadratic CPU exhaustion in js-yaml (npm) versions 4.1.1 and earlier allows unauthenticated remote attackers t MEDIUM CVE-2026-53655 6.9 This Month tar@2.2.2 Tar parser interpretation differential in node-tar (npm `tar` package) <= 7.5.15 allows a crafted archive to p MEDIUM CVE-2026-59875 5.3 This Month PoC tar@2.2.2 Process termination via crafted tar archive affects node-tar prior to 7.5.17, where NUL bytes in PAX path and MEDIUM CVE-2026-82417 6.3 This Month PoC qs@6.13.0 The `qs.stringify` function in the qs Node.js query-string library throws an uncaught `TypeError` when seriali MEDIUM CVE-2026-8723 6.3 This Month qs@6.13.0 The qs Node.js library (versions 6.11.1 through 6.15.1) crashes with a synchronous TypeError when stringify is MEDIUM CVE-2026-92963 6.9 This Month vm2@3.9.19 Untrusted JavaScript running inside a vm2 sandbox before version 3.11.2 can reach the host-side internal state LOW CVE-2025-46653 3.1 PoC formidable@2.1.2 Formidable (aka node-formidable) 2.1.0 through 3.x before 3.5.3 relies on hexoid to prevent guessing of filena LOW CVE-2025-54798 2.5 PoC tmp@0.0.33 tmp is a temporary file and directory creator for node.js. Rated low severity (CVSS 2.5). Public exploit code LOW CVE-2025-5889 1.3 brace-expansion@1.1.11 Inefficient regular expression complexity in brace-expansion up to versions 1.1.11/2.0.1/3.0.0/4.0.0 allows re LOW CVE-2025-69873 2.9 PoC ajv@5.5.2 ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS LOW CVE-2026-2391 3.7 PoC qs@6.13.0 ### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true LOW CVE-2026-24001 2.7 diff@3.5.0 Denial-of-service in jsdiff versions prior to 8.0.3, 5.2.2, 4.0.4, and 3.5.1 allows unauthenticated remote att LOW CVE-2026-41988 2.5 uuid@3.4.0 UUID library versions before 14.0.0 make unexpected writes to external output buffers when generating UUID ver LOW CVE-2026-49356 3.6 @babel/core@7.23.9 Arbitrary source map file read in @babel/core allows an attacker who controls Babel's input source code to exf LOW CVE-2026-77063 3.7 multer@1.4.4 Race condition in multer's file stream handling allows uploaded files exceeding the configured fileSize limit LOW CVE-2026-92962 2.1 vm2@3.9.19 Sandboxed JavaScript running in the npm package vm2 3.11.3 and earlier can install an accessor on Array.protot N/A CVE-2025-15284 qs@6.13.0 Vulnerability in qs, qs N/A CVE-2025-7338 multer@1.4.4 Vulnerability in multer N/A CVE-2025-7783 form-data@2.3.3 Vulnerability in form-data, form-data Show 163 more CVEs Show less