Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 3 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 406,595All CVEsplus 19,172 rejected
- 74Last 24 hours4,666 in the last 7 days
- 16,364Last 30 days1,442 of them critical
- 1,781Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 19 | 29 | 16 | 0 | 64 | 144 |
| 2025 | 0 | 5 | 3 | 2 | 0 | 10 | 80 |
| 2024 | 0 | 11 | 6 | 2 | 0 | 19 | 70 |
| 2023 | 2 | 13 | 4 | 0 | 0 | 19 | 51 |
| 2022 | 1 | 5 | 7 | 0 | 0 | 13 | 32 |
| 2021 | 2 | 5 | 5 | 0 | 0 | 12 | 19 |
| 2020 | 2 | 5 | 0 | 0 | 0 | 7 | 7 |
| Title | ||
|---|---|---|
| CVE-2026-126051 | Node.js is vulnerable to a remotely triggerable uncaught exception in TLS servers via deferred handshake callbacksnodejs · node | High7.5 |
| CVE-2026-123875 | Node.js is vulnerable to an HTTP/2 denial of service via a NULL pointer dereference when a respondWithFile() download is cancellednodejs · node | Medium5.9 |
| CVE-2026-123874 | Node.js is vulnerable to an HTTP/2 use-after-free via respondWithFile() stream reset during a pending writenodejs · node | High7.5 |
| CVE-2026-123872 | Node.js is vulnerable to a client certificate authentication bypass via TLS 1.2 renegotiation servername changenodejs · node | High8.1 |
| CVE-2026-123877 | Node.js is vulnerable to a certificate validation bypass in https.Agent via cross-policy TLS session reusenodejs · node | Medium6.8 |
| CVE-2026-123871 | Node.js is vulnerable to proxy credential disclosure via ERR_PROXY_INVALID_CONFIG error messagesnodejs · node | Medium6.2 |
| CVE-2026-123868 | Node.js is vulnerable to an HTTP/2 memory exhaustion denial of service via unaccounted inbound DATA on an undrained streamnodejs · node | Medium5.9 |
| CVE-2026-123867 | Node.js is vulnerable to a per-host mTLS authorization bypass via a CA-only SNI context failing open to the default CAnodejs · node | Medium4.2 |
| CVE-2026-123866 | Node.js is vulnerable to HTTP/2 response memory disclosure via a use-after-free during stream teardownnodejs · node | High7.5 |
| CVE-2026-123865 | Node.js is vulnerable to an HTTP/2 memory and file-descriptor leak via a protocol error during session shutdownnodejs · node | High7.5 |
| CVE-2026-123864 | Node.js is vulnerable to cross-connection memory disclosure via TLS write re-entrancy in the HTTPS request parsernodejs · node | High8.1 |
| CVE-2026-123863 | Node.js is vulnerable to a remote HTTP/2 denial of service via a reachable assertion in Http2Session teardownnodejs · node | High8.2 |
| CVE-2026-123862 | Node.js is vulnerable to a zlib denial of service via a stream destroy during a pending params() callnodejs · node | Low2.9 |
| CVE-2026-123829 | Node.js is vulnerable to Permission Model file-name disclosure via recursive fs.watchnodejs · node | Low2.5 |
| CVE-2026-123828 | Node.js is vulnerable to a heap buffer overflow in HTTP/2 session.altsvc() via a long originnodejs · node | Medium5.9 |
| CVE-2026-106069 | A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to,…nodejs · node | High7.4 |
| CVE-2026-105481 | A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an…nodejs · node | Medium6.5 |
| CVE-2026-105482 | A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an…nodejs · node | High7.4 |
| CVE-2026-106074 | A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into…nodejs · node | Medium4.8 |
| CVE-2026-106071 | A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule.…nodejs · node | Low3.6 |
| CVE-2026-106072 | A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a…nodejs · node | Medium6.7 |
| CVE-2026-105483 | A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the…nodejs · node | High7.4 |
| CVE-2026-106070 | A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation…nodejs · node | Low3.7 |
| CVE-2026-106073 | A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of…nodejs · node | Low3.3 |
| CVE-2026-48932 | A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible…nodejs · node | Low3.7 |
| CVE-2026-56848 | A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a…nodejs · node | High7.5 |
| CVE-2026-58042 | A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this…nodejs · node | Medium5.9 |
| CVE-2026-56846 | A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability…nodejs · node | High7.5 |
| CVE-2026-58044 | A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible…nodejs · node | Low3.7 |
| CVE-2026-58045 | A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing the entire process…nodejs · node | Medium6.2 |
| CVE-2026-58041 | A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared…nodejs · node | Medium5.3 |
| CVE-2026-58039 | A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths. This can lead to…nodejs · node | Low3.3 |
| CVE-2026-56847 | A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. This can lead to…nodejs · node | Low3.3 |
| CVE-2026-58043 | A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is…nodejs · node | High7.5 |
| CVE-2026-56850 | A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across…nodejs · node | Medium4.1 |
| CVE-2026-58040 | An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of…nodejs · node | Medium6.3 |
| CVE-2026-48930 | A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver…nodejs · node | Medium5.6 |
| CVE-2026-48928 | A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release…nodejs · node | Medium4.2 |
| CVE-2026-48934 | A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supported release lines:…nodejs · node | Medium4.3 |
| CVE-2026-48936 | A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission. This…nodejs · node | Low3.3 |
| CVE-2026-48618 | A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver…nodejs · node | High7.7 |
| CVE-2026-48933 | A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affects all…nodejs · node | High7.5 |
| CVE-2026-48935 | A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`. This…nodejs · node | Low3.3 |
| CVE-2026-48619 | A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client. This…nodejs · node | Medium5.3 |
| CVE-2026-48615 | A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials are embedded in the…nodejs · node | Medium5.9 |
| CVE-2026-48931 | A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This vulnerability affects…nodejs · node | Low3.7 |
| CVE-2026-48937 | A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This vulnerability affects two supported…nodejs · node | Medium5.3 |
| CVE-2026-48617 | A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. This can lead to confidentiality impact or…nodejs · node | Low1.8 |
| CVE-2026-21710 | A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses…nodejs · node | High7.5 |
| CVE-2026-21716 | An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while…nodejs · node | Low3.3 |