Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 9 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 405,491All CVEsplus 19,164 rejected
- 612Last 24 hours4,931 in the last 7 days
- 18,771Last 30 days1,593 of them critical
- 1,779Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 16 | 12 | 0 | 0 | 28 | 31 |
| 2025 | 0 | 0 | 1 | 0 | 0 | 1 | 3 |
| 2024 | 0 | 0 | 1 | 0 | 0 | 1 | 2 |
| 2023 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-101044 | pacquet before 12.0.0-alpha.5 Path Traversal via lockfile aliaspnpm · pnpm | High7.1 |
| CVE-2026-101043 | pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy SettingsPublic exploitpnpm · pnpm | High8.3 |
| CVE-2026-82393 | pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on installPublic exploitpnpm · pnpm | High7.5 |
| CVE-2026-82392 | pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraphpnpm · pnpm | High7.1 |
| CVE-2026-59195 | pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-configPublic exploitpnpm · pnpm | High8.2 |
| CVE-2026-59196 | pnpm: hoisted install imports lockfile alias outside node_modulespnpm · pnpm | High7.1 |
| CVE-2026-59194 | pnpm: patch-remove could delete project-selected files outside the patches directorypnpm · pnpm | High7.1 |
| CVE-2026-55180 | pnpm: Repository config can expand victim environment secrets into registry requests before scripts runPublic exploitpnpm · pnpm | Medium6.5 |
| CVE-2026-48995 | pnpm: Tarball hash of GitHub git dependencies is not stored in lockfilePublic exploitpnpm · pnpm | Medium4.8 |
| CVE-2026-50017 | pnpm binds unscoped user-level npm auth credentials to a repository-selected registrypnpm · pnpm | Medium6.9 |
| CVE-2026-50016 | pnpm: Transitive dependency alias path traversal allows project path override via symlink replacementPublic exploitpnpm · pnpm | High8.8 |
| CVE-2026-50015 | pnpm: Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)Public exploitpnpm · pnpm | High7.3 |
| CVE-2026-50014 | pnpm: Git Fetch Argument Injection via Lockfile resolution.commitPublic exploitpnpm · pnpm | Medium6.4 |
| CVE-2026-50573 | pnpm: Unsafe default behavior breaks integrity checkPublic exploitpnpm · pnpm | Medium6.8 |
| CVE-2026-50021 | pnpm: Integrity Check Bypass via Missing Lockfile Integrity FieldPublic exploitpnpm · pnpm | Medium6.8 |
| CVE-2026-55700 | pnpm: stage download writes outside destination via manifest version traversalpnpm · pnpm | High7.1 |
| CVE-2026-55699 | pnpm: reserved bin name deletes PNPM_HOME during global removePublic exploitpnpm · pnpm | Medium6.5 |
| CVE-2026-55698 | pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytesPublic exploitpnpm · pnpm | High8.8 |
| CVE-2026-55697 | pnpm: Repository-controlled configDependencies can select a pacquet native install enginePublic exploitpnpm · pnpm | High7.5 |
| CVE-2026-55487 | pnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecyclePublic exploitpnpm · pnpm | High7.5 |
| CVE-2026-24131 | pnpm has Path Traversal via arbitrary file permission modificationpnpm · pnpm | Medium6.7 |
| CVE-2026-24056 | pnpm has symlink traversal in file:/git dependenciesPublic exploitpnpm · pnpm | Medium6.7 |
| CVE-2026-23890 | pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.binPublic exploitpnpm · pnpm | Medium6.5 |
| CVE-2026-23889 | pnpm has Windows-specific tarball Path TraversalPublic exploitpnpm · pnpm | Medium6.5 |
| CVE-2026-23888 | pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)Public exploitpnpm · pnpm | Medium6.5 |
| CVE-2025-69262 | pnpm vulnerable to Command Injection via environment variable substitutionPublic exploitpnpm · pnpm | High7.6 |
| CVE-2025-69264 | pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"Public exploitpnpm · pnpm | High8.8 |
| CVE-2025-69263 | pnpm Lockfile Integrity Bypass Allows Remote Dynamic DependenciesPublic exploitpnpm · pnpm | High7.5 |
| CVE-2024-47829 | pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwritingpnpm · pnpm | Medium6.5 |
| CVE-2024-53866 | pnpm vulnerable to no-script global cache poisoning via overrides / `ignore-scripts` evasionPublic exploitpnpm · pnpm | Medium5.8 |
| CVE-2023-37478 | pnpm incorrectly parses tar archives relative to specificationPublic exploitpnpm · pnpm | High7.5 |