Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 8 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,095All CVEsplus 18,873 rejected
- 780Last 24 hours3,297 in the last 7 days
- 17,421Last 30 days1,561 of them critical
- 1,766Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 0 | 0 | 0 | 0 | 0 | 18 |
| 2025 | 0 | 0 | 0 | 0 | 0 | 0 | 18 |
| 2024 | 0 | 0 | 0 | 0 | 0 | 0 | 18 |
| 2023 | 0 | 0 | 0 | 0 | 0 | 0 | 18 |
| 2022 | 0 | 0 | 0 | 0 | 0 | 0 | 18 |
| 2021 | 0 | 0 | 0 | 0 | 0 | 0 | 18 |
| 2020 | 0 | 0 | 0 | 0 | 0 | 0 | 18 |
| 2019 | 0 | 2 | 0 | 0 | 0 | 2 | 18 |
| 2018 | 0 | 12 | 2 | 0 | 0 | 14 | 16 |
| 2017 | 1 | 0 | 0 | 1 | 0 | 2 | 2 |
| Title | ||
|---|---|---|
| CVE-2019-5739 | Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated…Node.js · Node.js | High7.5 |
| CVE-2019-5737 | In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by…Node.js · Node.js | High7.5 |
| CVE-2018-12123 | Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is…The Node.js Project · Node.js | Medium4.3 |
| CVE-2018-12122 | Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by…The Node.js Project · Node.js | High7.5 |
| CVE-2018-12121 | Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests…The Node.js Project · Node.js | High7.5 |
| CVE-2018-12120 | Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with `node --debug` or…The Node.js Project · Node.js | High8.1 |
| CVE-2018-12116 | Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for…The Node.js Project · Node.js | High7.5 |
| CVE-2018-12115 | In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, `'ucs-2'`,…The Node.js Project · Node.js | High7.5 |
| CVE-2018-7166 | In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This method is intended…The Node.js Project · Node.js | High7.5 |
| CVE-2018-7167 | Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this…The Node.js Project · Node.js | High7.5 |
| CVE-2018-7164 | Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from…The Node.js Project · Node.js | High7.5 |
| CVE-2018-7162 | All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node process which…The Node.js Project · Node.js | High7.5 |
| CVE-2018-7161 | All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node server…The Node.js Project · Node.js | High7.5 |
| CVE-2018-7160 | The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is…The Node.js Project · Node.js | High8.8 |
| CVE-2018-7159 | The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be…The Node.js Project · Node.js | Medium5.3 |
| CVE-2018-7158 | The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced…The Node.js Project · Node.js | High7.5 |
| CVE-2017-15897 | Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified.…The Node.js Project · Node.js | Low3.1 |
| CVE-2017-15896 | Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake failure. The result was that an active…The Node.js Project · Node.js | Critical9.1 |