Skip to main content
cve.nowby Sazabi
The cve.now Index

Packages on the cve.now Index

Open source packages ranked by the score of their worst CVE published or escalated in the window, then by how many they have. How the score works.

  1. 195react-server-dom-parcelWorst: CVE-2025-55182 Meta react-server-dom-webpack · Meta react-server-dom-tu… +4: A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 inclunpm4 CVEs in this window
  2. 295react-server-dom-turbopackWorst: CVE-2025-55182 Meta react-server-dom-webpack · Meta react-server-dom-tu… +4: A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 inclunpm4 CVEs in this window
  3. 395react-server-dom-webpackWorst: CVE-2025-55182 Meta react-server-dom-webpack · Meta react-server-dom-tu… +4: A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 inclunpm4 CVEs in this window
  4. 492org.jenkins-ci.main:jenkins-coreWorst: CVE-2024-23897 Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core: Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character folloMaven7 CVEs in this window
  5. 592electronWorst: CVE-2022-4135 Google Chrome · electron: Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to pnpm5 CVEs in this window
  6. 692CefSharp.CommonWorst: CVE-2020-15999 Google Chrome · CefSharp.Common +3: Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption viNuGet3 CVEs in this window
  7. 792CefSharp.WinFormsWorst: CVE-2020-15999 Google Chrome · CefSharp.Common +3: Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption viNuGet3 CVEs in this window
  8. 892CefSharp.WpfWorst: CVE-2020-15999 Google Chrome · CefSharp.Common +3: Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption viNuGet3 CVEs in this window
  9. 992CefSharp.Wpf.HwndHostWorst: CVE-2020-15999 Google Chrome · CefSharp.Common +3: Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption viNuGet3 CVEs in this window
  10. 1092org.apache.logging.log4j:log4j-coreWorst: CVE-2021-44228 Apache Software Foundation Apache Log4j2 · org.apache.lo… +4: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpointsMaven2 CVEs in this window
  11. 1192org.ops4j.pax.logging:pax-logging-log4j2Worst: CVE-2021-44228 Apache Software Foundation Apache Log4j2 · org.apache.lo… +4: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpointsMaven2 CVEs in this window
  12. 1292com.guicedee.services:log4j-coreWorst: CVE-2021-44228 Apache Software Foundation Apache Log4j2 · org.apache.lo… +4: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpointsMaven1 CVE in this window
  13. 1392org.springframework:spring-beansWorst: CVE-2022-22965 Spring Framework · org.springframework:spring-beans +4: A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.Maven1 CVE in this window
  14. 1492org.springframework:spring-webfluxWorst: CVE-2022-22965 Spring Framework · org.springframework:spring-beans +4: A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.Maven1 CVE in this window
  15. 1592org.springframework:spring-webmvcWorst: CVE-2022-22965 Spring Framework · org.springframework:spring-beans +4: A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.Maven1 CVE in this window
  16. 1692org.springframework.boot:spring-boot-starter-webWorst: CVE-2022-22965 Spring Framework · org.springframework:spring-beans +4: A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.Maven1 CVE in this window
  17. 1792org.springframework.boot:spring-boot-starter-webfluxWorst: CVE-2022-22965 Spring Framework · org.springframework:spring-beans +4: A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.Maven1 CVE in this window
  18. 1892org.springframework.cloud:spring-cloud-function-contextWorst: CVE-2022-22963 Spring Cloud Function · org.springframework.cloud:spring-cl…: In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user toMaven1 CVE in this window
  19. 1992org.springframework.cloud:spring-cloud-gatewayWorst: CVE-2022-22947 Spring Cloud Gateway · org.springframework.cloud:spring-clo…: In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway ActuatMaven1 CVE in this window
  20. 2092Porg.springframework.data:spring-data-commonsWorst: CVE-2018-1273 Spring by Pivotal Spring Framework · org.springframework.da…: Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerabilitMaven1 CVE in this window
  21. 2192org.xbib.elasticsearch:log4jWorst: CVE-2021-44228 Apache Software Foundation Apache Log4j2 · org.apache.lo… +4: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpointsMaven1 CVE in this window
  22. 2292uk.co.nichesolutions.logging.log4j:log4j-coreWorst: CVE-2021-44228 Apache Software Foundation Apache Log4j2 · org.apache.lo… +4: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpointsMaven1 CVE in this window
  23. 2392brotliWorst: CVE-2026-111497 Google Brotli · node +6: Out-of-Bounds Write in Google Brotli DecoderPyPI1 CVE in this window
  24. 2492brotlicffiWorst: CVE-2026-111497 Google Brotli · node +6: Out-of-Bounds Write in Google Brotli DecoderPyPI1 CVE in this window
  25. 2591pillowWorst: CVE-2023-4863 Google Chrome · Google libwebp +13: Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of boPyPI27 CVEs in this window
  26. 2691litellmWorst: CVE-2026-42208 BerriAI litellm · litellm: LiteLLM: SQL injection in Proxy API key verificationPyPI6 CVEs in this window
  27. 2791rayWorst: CVE-2025-62593 ray-project ray · ray: Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding AttackPyPI4 CVEs in this window
  28. 2891libwebp-sysWorst: CVE-2023-4863 Google Chrome · Google libwebp +13: Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bocrates.io1 CVE in this window
  29. 2991libwebp-sys2Worst: CVE-2023-4863 Google Chrome · Google libwebp +13: Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bocrates.io1 CVE in this window
  30. 3091webpWorst: CVE-2023-4863 Google Chrome · Google libwebp +13: Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bocrates.io1 CVE in this window
  31. 3191github.com/chai2010/webpWorst: CVE-2023-4863 Google Chrome · Google libwebp +13: Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of boGo1 CVE in this window
  32. 3291PCefSharp.Common.NETCoreWorst: CVE-2022-0609 Google Chrome · CefSharp.Common +8: Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a cNuGet1 CVE in this window
  33. 3391PCefSharp.OffScreenWorst: CVE-2022-0609 Google Chrome · CefSharp.Common +8: Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a cNuGet1 CVE in this window
  34. 3491PCefSharp.OffScreen.NETCoreWorst: CVE-2022-0609 Google Chrome · CefSharp.Common +8: Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a cNuGet1 CVE in this window
  35. 3591PCefSharp.WinForms.NETCoreWorst: CVE-2022-0609 Google Chrome · CefSharp.Common +8: Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a cNuGet1 CVE in this window
  36. 3691PCefSharp.Wpf.NETCoreWorst: CVE-2022-0609 Google Chrome · CefSharp.Common +8: Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a cNuGet1 CVE in this window
  37. 3791magick.net-q16-anycpuWorst: CVE-2023-4863 Google Chrome · Google libwebp +13: Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of boNuGet1 CVE in this window
  38. 3891magick.net-q16-hdri-anycpuWorst: CVE-2023-4863 Google Chrome · Google libwebp +13: Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of boNuGet1 CVE in this window
  39. 3991magick.net-q16-x64Worst: CVE-2023-4863 Google Chrome · Google libwebp +13: Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of boNuGet1 CVE in this window
  40. 4091magick.net-q8-anycpuWorst: CVE-2023-4863 Google Chrome · Google libwebp +13: Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of boNuGet1 CVE in this window
  41. 4191magick.net-q8-openmp-x64Worst: CVE-2023-4863 Google Chrome · Google libwebp +13: Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of boNuGet1 CVE in this window
  42. 4291magick.net-q8-x64Worst: CVE-2023-4863 Google Chrome · Google libwebp +13: Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of boNuGet1 CVE in this window
  43. 4391SkiaSharpWorst: CVE-2023-4863 Google Chrome · Google libwebp +13: Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of boNuGet1 CVE in this window
  44. 4490mlflowWorst: CVE-2026-64849 mlflow: MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)PyPI6 CVEs in this window
  45. 4590org.springframework.cloud:spring-cloud-config-serverWorst: CVE-2020-5410 Spring by VMware Spring Cloud Config · org.springframework.…: Directory Traversal with spring-cloud-config-serverMaven2 CVEs in this window
  46. 4689Porg.webjars.npm:jqueryWorst: CVE-2020-11023 jQuery · jquery-rails +2: Potential XSS vulnerability in jQueryMaven1 CVE in this window
  47. 4789PjqueryWorst: CVE-2020-11023 jQuery · jquery-rails +2: Potential XSS vulnerability in jQuerynpm1 CVE in this window
  48. 4889PpuppeteerWorst: CVE-2019-5786 Google Chrome · puppeteer: Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memorynpm1 CVE in this window
  49. 4989PjQueryWorst: CVE-2020-11023 jQuery · jquery-rails +2: Potential XSS vulnerability in jQueryNuGet1 CVE in this window
  50. 5088org.jenkins-ci.plugins:script-securityWorst: CVE-2019-1003029 Jenkins project Jenkins Script Security Plugin · org.jenkin…: A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecuriMaven4 CVEs in this window

Do you depend on one of these? Scan your lockfile.