Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 8 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,118All CVEsplus 19,119 rejected
- 460Last 24 hours2,757 in the last 7 days
- 16,877Last 30 days1,552 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 12 | 24 | 14 | 0 | 50 | 144 |
| 2025 | 0 | 5 | 4 | 3 | 0 | 12 | 94 |
| 2024 | 0 | 11 | 7 | 6 | 0 | 24 | 82 |
| 2023 | 2 | 14 | 5 | 1 | 0 | 22 | 58 |
| 2022 | 1 | 5 | 10 | 1 | 0 | 17 | 36 |
| 2021 | 2 | 5 | 5 | 0 | 0 | 12 | 19 |
| 2020 | 2 | 5 | 0 | 0 | 0 | 7 | 7 |
| Title | ||
|---|---|---|
| CVE-2026-106069 | A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to,…nodejs · node | High7.4 |
| CVE-2026-105481 | A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an…nodejs · node | Medium6.5 |
| CVE-2026-105482 | A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an…nodejs · node | High7.4 |
| CVE-2026-106074 | A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into…nodejs · node | Medium4.8 |
| CVE-2026-106071 | A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule.…nodejs · node | Low3.6 |
| CVE-2026-106072 | A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a…nodejs · node | Medium6.7 |
| CVE-2026-105483 | A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the…nodejs · node | High7.4 |
| CVE-2026-106070 | A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation…nodejs · node | Low3.7 |
| CVE-2026-106073 | A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of…nodejs · node | Low3.3 |
| CVE-2026-48932 | A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible…nodejs · node | Low3.7 |
| CVE-2026-56848 | A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a…nodejs · node | High7.5 |
| CVE-2026-58042 | A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this…nodejs · node | Medium5.9 |
| CVE-2026-56846 | A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability…nodejs · node | High7.5 |
| CVE-2026-58044 | A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible…nodejs · node | Low3.7 |
| CVE-2026-58045 | A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing the entire process…nodejs · node | Medium6.2 |
| CVE-2026-58041 | A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared…nodejs · node | Medium5.3 |
| CVE-2026-58039 | A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths. This can lead to…nodejs · node | Low3.3 |
| CVE-2026-56847 | A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. This can lead to…nodejs · node | Low3.3 |
| CVE-2026-58043 | A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is…nodejs · node | High7.5 |
| CVE-2026-56850 | A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across…nodejs · node | Medium4.1 |
| CVE-2026-58040 | An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of…nodejs · node | Medium6.3 |
| CVE-2026-48930 | A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver…nodejs · node | Medium5.6 |
| CVE-2026-48928 | A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release…nodejs · node | Medium4.2 |
| CVE-2026-48934 | A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supported release lines:…nodejs · node | Medium4.3 |
| CVE-2026-48936 | A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission. This…nodejs · node | Low3.3 |
| CVE-2026-48618 | A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver…nodejs · node | High7.7 |
| CVE-2026-48933 | A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affects all…nodejs · node | High7.5 |
| CVE-2026-48935 | A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`. This…nodejs · node | Low3.3 |
| CVE-2026-48619 | A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client. This…nodejs · node | Medium5.3 |
| CVE-2026-48615 | A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials are embedded in the…nodejs · node | Medium5.9 |
| CVE-2026-48931 | A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This vulnerability affects…nodejs · node | Low3.7 |
| CVE-2026-48937 | A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This vulnerability affects two supported…nodejs · node | Medium5.3 |
| CVE-2026-48617 | A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. This can lead to confidentiality impact or…nodejs · node | Low1.8 |
| CVE-2026-21710 | A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses…nodejs · node | High7.5 |
| CVE-2026-21716 | An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while…nodejs · node | Low3.3 |
| CVE-2026-21711 | A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all…nodejs · node | Medium5.3 |
| CVE-2026-21715 | A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable…nodejs · node | Low3.3 |
| CVE-2026-21717 | A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By…nodejs · node | Medium5.9 |
| CVE-2026-21713 | A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information…nodejs · node | Medium5.9 |
| CVE-2026-21714 | A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to…nodejs · node | Medium5.3 |
| CVE-2026-21712 | A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalized domain name (IDN)…nodejs · node | Medium5.7 |
| CVE-2026-21636 | A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without…nodejs · node | Medium5.8 |
| CVE-2025-59466 | We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is…nodejs · node | Medium5.9 |
| CVE-2025-55132 | A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read…nodejs · node | Low2.8 |
| CVE-2025-59464 | A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When…nodejs · node | Medium6.5 |
| CVE-2025-55131 | A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout…nodejs · node | High7.1 |
| CVE-2025-55130 | A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By…nodejs · node | High7.1 |
| CVE-2026-21637 | A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use.…nodejs · node | Medium5.9 |
| CVE-2025-59465 | A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`.…nodejs · node | High7.5 |
| CVE-2026-22036 | Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustionnodejs · undici | Medium5.9 |