CycloneDX vulnerabilities
6 published CVEs name CycloneDX among the affected products.
- 6Published CVEs6 of them scored
- 2Last 12 monthspublished in the last year
- 0Critical6 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-71538
@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows
CycloneDX · cyclonedx-node-npm
High8.5 - CVE-2026-55849
@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized `--workspace` Argument
CycloneDX · cyclonedx-node-npm
High8.5 - CVE-2025-64518
CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection
CycloneDX · cyclonedx-core-java
High7.5 - CVE-2024-38374
Improper Restriction of XML External Entity Reference in org.cyclonedx:cyclonedx-core-java
CycloneDX · cyclonedx-core-java
High7.5 - CVE-2024-34345
@cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability
CycloneDX · cyclonedx-javascript-library
High8.1 - CVE-2022-24774
Improper Input Validation leading to Path Traversal in CycloneDX BOM Repository Server
CycloneDX · cyclonedx-bom-repo-server
High7.1