Skip to main content
cve.nowby Sazabi
The cve.now Index

Packages on the cve.now Index

Open source packages ranked by the score of their worst CVE published or escalated in the window, then by how many they have. How the score works.

  1. 192brotliWorst: CVE-2026-111497 Google Brotli · node +6: Out-of-Bounds Write in Google Brotli DecoderPyPI1 CVE in this window
  2. 292brotlicffiWorst: CVE-2026-111497 Google Brotli · node +6: Out-of-Bounds Write in Google Brotli DecoderPyPI1 CVE in this window
  3. 391litellmWorst: CVE-2026-42208 BerriAI litellm · litellm: LiteLLM: SQL injection in Proxy API key verificationPyPI4 CVEs in this window
  4. 481rayWorst: CVE-2023-48022 ray: Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API.PyPI3 CVEs in this window
  5. 580Porg.apache.tomcat:tomcatWorst: CVE-2026-34486 Apache Software Foundation Apache Tomcat · org.apache.to… +1: Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptorMaven5 CVEs in this window
  6. 680nextWorst: CVE-2025-29927 vercel next.js · next: Authorization Bypass in Next.js Middlewarenpm2 CVEs in this window
  7. 780Porg.apache.tomcat:tomcat-tribesWorst: CVE-2026-34486 Apache Software Foundation Apache Tomcat · org.apache.to… +1: Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptorMaven1 CVE in this window
  8. 877github.com/aquasecurity/trivyWorst: CVE-2026-33634 aquasecurity setup-trivy · aquasecurity trivy-action +6: Trivy ecosystem supply chain briefly compromisedGo1 CVE in this window
  9. 975net.opentsdb:opentsdbWorst: CVE-2023-25826 OpenTSDB · net.opentsdb:opentsdb: Remote Code Execution in OpenTSDBMaven3 CVEs in this window
  10. 1075github.com/0xJacky/Nginx-UIWorst: CVE-2026-33032 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI: Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx TakeoverGo2 CVEs in this window
  11. 1175pyload-ngWorst: CVE-2024-39205 pyload-ng: An issue in pyload-ng v0.5.0b3.dev85 running under python3.11 or below allows attackers to execute arbitrary code via a crafted HTTP requestPyPI2 CVEs in this window
  12. 1272vllmWorst: CVE-2026-22778 vllm-project vllm · vllm: vLLM leaks a heap address when PIL throws an errorPyPI3 CVEs in this window
  13. 1372djangoWorst: CVE-2025-64459 djangoproject Django · django: Potential SQL injection via _connector keyword argument in QuerySet and Q objectsPyPI2 CVEs in this window
  14. 1471chromadbWorst: CVE-2026-45829 ChromaDB: A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attackPyPI1 CVE in this window
  15. 1570flowiseWorst: CVE-2025-58434 FlowiseAI Flowise · flowise: Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeovernpm9 CVEs in this window
  16. 1670langflowWorst: CVE-2026-27966 langflow-ai langflow · langflow: Langflow has Remote Code Execution in CSV AgentPyPI4 CVEs in this window
  17. 1770@paperclipai/serverWorst: CVE-2026-41679 paperclipai paperclip · @paperclipai/server +1: Paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypassnpm2 CVEs in this window
  18. 1870bentomlWorst: CVE-2025-27520 BentoML: BentoML Allows Remote Code Execution (RCE) via Insecure DeserializationPyPI2 CVEs in this window
  19. 1970@mcpjam/inspectorWorst: CVE-2026-23744 MCPJam inspector · @mcpjam/inspector: REC in MCPJam inspector due to HTTP Endpoint exposesnpm1 CVE in this window
  20. 2070paperclipaiWorst: CVE-2026-41679 paperclipai paperclip · @paperclipai/server +1: Paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypassnpm1 CVE in this window
  21. 2170dtaleWorst: CVE-2024-3408 man-group/dtale · dtale: Authentication Bypass and RCE in man-group/dtalePyPI1 CVE in this window
  22. 2270torchserveWorst: CVE-2023-43654 pytorch serve · torchserve: TorchServe Server-Side Request ForgeryPyPI1 CVE in this window
  23. 2369axiosWorst: CVE-2026-44492 axios: Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)npm1 CVE in this window
  24. 2468react-server-dom-parcelWorst: CVE-2025-55184 Meta react-server-dom-webpack · Meta react-server-dom-tu… +4: A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.npm3 CVEs in this window
  25. 2568react-server-dom-turbopackWorst: CVE-2025-55184 Meta react-server-dom-webpack · Meta react-server-dom-tu… +4: A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.npm3 CVEs in this window
  26. 2668react-server-dom-webpackWorst: CVE-2025-55184 Meta react-server-dom-webpack · Meta react-server-dom-tu… +4: A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.npm3 CVEs in this window
  27. 2768joserfcWorst: CVE-2026-119283 authlib joserfc · joserfc: joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key DecryptionPyPI1 CVE in this window
  28. 2867Porg.bouncycastle:bcprov-jdk15onWorst: CVE-2017-13098 Legion of the Bouncy Castle BouncyCastle TLS · org.bouncyca…: BouncyCastle JCE TLS Bleichenbacher/ROBOTMaven1 CVE in this window
  29. 2966systeminformationWorst: CVE-2025-68154 sebhildebrandt systeminformation · systeminformation: Command Injection in fsSize() on Windowsnpm2 CVEs in this window
  30. 3065mlflowWorst: CVE-2026-2652 mlflow/mlflow · mlflow: Authentication Bypass in mlflow/mlflowPyPI3 CVEs in this window
  31. 3165@react-router/nodeWorst: CVE-2025-61686 remix-run react-router · @react-router/node +2: React Router has Path Traversal in File Session Storagenpm1 CVE in this window
  32. 3265@remix-run/denoWorst: CVE-2025-61686 remix-run react-router · @react-router/node +2: React Router has Path Traversal in File Session Storagenpm1 CVE in this window
  33. 3365@remix-run/nodeWorst: CVE-2025-61686 remix-run react-router · @react-router/node +2: React Router has Path Traversal in File Session Storagenpm1 CVE in this window
  34. 3465aiohttpWorst: CVE-2024-23334 aio-libs aiohttp · aiohttp: aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversalPyPI1 CVE in this window
  35. 3563dify-clientWorst: CVE-2025-63387 dify-client: Dify v1.9.1 is vulnerable to Insecure Permissions.PyPI1 CVE in this window
  36. 3662k8s.io/ingress-nginxWorst: CVE-2025-1974 kubernetes ingress-nginx · k8s.io/ingress-nginx: ingress-nginx admission controller RCE escalationGo4 CVEs in this window
  37. 3762n8nWorst: CVE-2026-21858 n8n-io n8n · n8n: n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handlingnpm4 CVEs in this window
  38. 3862Porg.eclipse.jetty:jetty-webappWorst: CVE-2021-28164 The Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…: In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segmMaven2 CVEs in this window
  39. 3962praisonaiagentsWorst: CVE-2026-61447 MervinPraison PraisonAI · praisonaiagents: PraisonAI before 1.6.78 Remote Code Execution via CodeAgentPyPI2 CVEs in this window
  40. 4062ghostWorst: CVE-2026-26980 TryGhost Ghost · ghost: Ghost has a SQL Injection in its Content APInpm1 CVE in this window
  41. 4160github.com/grafana/grafanaWorst: CVE-2025-41115 Grafana Enterprise · github.com/grafana/grafana: Incorrect privilege assignmentGo4 CVEs in this window
  42. 4260fuxa-serverWorst: CVE-2026-25939 frangoteam FUXA · fuxa-server: FUXA Unauthenticated Remote Arbitrary Scheduler Writenpm2 CVEs in this window
  43. 4360rustfsWorst: CVE-2025-68926 rustfs: RustFS has a gRPC Hardcoded Token Authentication Bypasscrates.io1 CVE in this window
  44. 4460github.com/milvus-io/milvusWorst: CVE-2026-26190 milvus-io milvus · github.com/milvus-io/milvus: Milvus Allows Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System CompromiseGo1 CVE in this window
  45. 4560github.com/opencontainers/runcWorst: CVE-2024-21626 opencontainers runc · github.com/opencontainers/runc: runc container breakout through process.cwd trickery and leaked fdsGo1 CVE in this window
  46. 4660github.com/rclone/rcloneWorst: CVE-2026-41176 rclone · github.com/rclone/rclone: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command executionGo1 CVE in this window
  47. 4760org.apache.activemq:artemis-serverWorst: CVE-2026-27446 Apache Software Foundation Apache Artemis · Apache Softw… +2: Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federationMaven1 CVE in this window
  48. 4860org.apache.artemis:artemis-serverWorst: CVE-2026-27446 Apache Software Foundation Apache Artemis · Apache Softw… +2: Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federationMaven1 CVE in this window
  49. 4960org.apache.camel:camel-cxf-restWorst: CVE-2026-47323 Apache Software Foundation Apache Camel · org.apache.camel:…: Apache Camel: Camel-CXF Message Header Injection via Missing Inbound FilteringMaven1 CVE in this window
  50. 5060langflow-baseWorst: CVE-2026-21445 langflow-ai langflow · langflow-base +1: Langflow Missing Authentication on Critical API EndpointsPyPI1 CVE in this window

Do you depend on one of these? Scan your lockfile.