Skip to main content
cve.nowby Sazabi
The cve.now Index

Packages on the cve.now Index

Open source packages ranked by the score of their worst CVE published or escalated in the window, then by how many they have. How the score works.

  1. 195react-server-dom-parcelWorst: CVE-2025-55182 Meta react-server-dom-webpack · Meta react-server-dom-tu… +4: A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 inclunpm8 CVEs in this window
  2. 295react-server-dom-turbopackWorst: CVE-2025-55182 Meta react-server-dom-webpack · Meta react-server-dom-tu… +4: A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 inclunpm8 CVEs in this window
  3. 395react-server-dom-webpackWorst: CVE-2025-55182 Meta react-server-dom-webpack · Meta react-server-dom-tu… +4: A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 inclunpm8 CVEs in this window
  4. 492electronWorst: CVE-2022-4135 Google Chrome · electron: Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to pnpm19 CVEs in this window
  5. 592org.jenkins-ci.main:jenkins-coreWorst: CVE-2024-23897 Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core: Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character folloMaven11 CVEs in this window
  6. 692org.springframework:spring-webmvcWorst: CVE-2022-22965 Spring Framework · org.springframework:spring-beans +4: A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.Maven5 CVEs in this window
  7. 792org.springframework:spring-webfluxWorst: CVE-2022-22965 Spring Framework · org.springframework:spring-beans +4: A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.Maven4 CVEs in this window
  8. 892Porg.springframework.data:spring-data-commonsWorst: CVE-2018-1273 Spring by Pivotal Spring Framework · org.springframework.da…: Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerabilitMaven3 CVEs in this window
  9. 992CefSharp.CommonWorst: CVE-2020-15999 Google Chrome · CefSharp.Common +3: Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption viNuGet3 CVEs in this window
  10. 1092CefSharp.WinFormsWorst: CVE-2020-15999 Google Chrome · CefSharp.Common +3: Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption viNuGet3 CVEs in this window
  11. 1192CefSharp.WpfWorst: CVE-2020-15999 Google Chrome · CefSharp.Common +3: Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption viNuGet3 CVEs in this window
  12. 1292CefSharp.Wpf.HwndHostWorst: CVE-2020-15999 Google Chrome · CefSharp.Common +3: Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption viNuGet3 CVEs in this window
  13. 1392starletteWorst: CVE-2026-48710 Kludex starlette · starlette: Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checksPyPI3 CVEs in this window
  14. 1492org.apache.logging.log4j:log4j-coreWorst: CVE-2021-44228 Apache Software Foundation Apache Log4j2 · org.apache.lo… +4: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpointsMaven2 CVEs in this window
  15. 1592org.ops4j.pax.logging:pax-logging-log4j2Worst: CVE-2021-44228 Apache Software Foundation Apache Log4j2 · org.apache.lo… +4: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpointsMaven2 CVEs in this window
  16. 1692org.springframework.cloud:spring-cloud-gatewayWorst: CVE-2022-22947 Spring Cloud Gateway · org.springframework.cloud:spring-clo…: In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway ActuatMaven2 CVEs in this window
  17. 1792@tanstack/react-startWorst: CVE-2026-45321 @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keysnpm2 CVEs in this window
  18. 1892@tanstack/solid-startWorst: CVE-2026-45321 @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keysnpm2 CVEs in this window
  19. 1992@tanstack/start-server-coreWorst: CVE-2026-45321 @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keysnpm2 CVEs in this window
  20. 2092@tanstack/vue-startWorst: CVE-2026-45321 @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keysnpm2 CVEs in this window
  21. 2192com.guicedee.services:log4j-coreWorst: CVE-2021-44228 Apache Software Foundation Apache Log4j2 · org.apache.lo… +4: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpointsMaven1 CVE in this window
  22. 2292org.springframework:spring-beansWorst: CVE-2022-22965 Spring Framework · org.springframework:spring-beans +4: A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.Maven1 CVE in this window
  23. 2392org.springframework.boot:spring-boot-starter-webWorst: CVE-2022-22965 Spring Framework · org.springframework:spring-beans +4: A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.Maven1 CVE in this window
  24. 2492org.springframework.boot:spring-boot-starter-webfluxWorst: CVE-2022-22965 Spring Framework · org.springframework:spring-beans +4: A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.Maven1 CVE in this window
  25. 2592org.springframework.cloud:spring-cloud-function-contextWorst: CVE-2022-22963 Spring Cloud Function · org.springframework.cloud:spring-cl…: In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user toMaven1 CVE in this window
  26. 2692org.xbib.elasticsearch:log4jWorst: CVE-2021-44228 Apache Software Foundation Apache Log4j2 · org.apache.lo… +4: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpointsMaven1 CVE in this window
  27. 2792uk.co.nichesolutions.logging.log4j:log4j-coreWorst: CVE-2021-44228 Apache Software Foundation Apache Log4j2 · org.apache.lo… +4: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpointsMaven1 CVE in this window
  28. 2892@tanstack/arktype-adapterWorst: CVE-2026-45321 @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keysnpm1 CVE in this window
  29. 2992@tanstack/eslint-plugin-routerWorst: CVE-2026-45321 @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keysnpm1 CVE in this window
  30. 3092@tanstack/eslint-plugin-startWorst: CVE-2026-45321 @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keysnpm1 CVE in this window
  31. 3192@tanstack/historyWorst: CVE-2026-45321 @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keysnpm1 CVE in this window
  32. 3292@tanstack/nitro-v2-vite-pluginWorst: CVE-2026-45321 @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keysnpm1 CVE in this window
  33. 3392@tanstack/react-routerWorst: CVE-2026-45321 @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keysnpm1 CVE in this window
  34. 3492@tanstack/react-router-devtoolsWorst: CVE-2026-45321 @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keysnpm1 CVE in this window
  35. 3592@tanstack/react-router-ssr-queryWorst: CVE-2026-45321 @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keysnpm1 CVE in this window
  36. 3692@tanstack/react-start-clientWorst: CVE-2026-45321 @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keysnpm1 CVE in this window
  37. 3792@tanstack/react-start-rscWorst: CVE-2026-45321 @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keysnpm1 CVE in this window
  38. 3892@tanstack/react-start-serverWorst: CVE-2026-45321 @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keysnpm1 CVE in this window
  39. 3992@tanstack/router-cliWorst: CVE-2026-45321 @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keysnpm1 CVE in this window
  40. 4092@tanstack/router-coreWorst: CVE-2026-45321 @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keysnpm1 CVE in this window
  41. 4192@tanstack/router-devtoolsWorst: CVE-2026-45321 @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keysnpm1 CVE in this window
  42. 4292@tanstack/router-devtools-coreWorst: CVE-2026-45321 @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keysnpm1 CVE in this window
  43. 4392@tanstack/router-generatorWorst: CVE-2026-45321 @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keysnpm1 CVE in this window
  44. 4492@tanstack/router-pluginWorst: CVE-2026-45321 @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keysnpm1 CVE in this window
  45. 4592@tanstack/router-ssr-query-coreWorst: CVE-2026-45321 @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keysnpm1 CVE in this window
  46. 4692@tanstack/router-utilsWorst: CVE-2026-45321 @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keysnpm1 CVE in this window
  47. 4792@tanstack/router-vite-pluginWorst: CVE-2026-45321 @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keysnpm1 CVE in this window
  48. 4892@tanstack/solid-routerWorst: CVE-2026-45321 @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keysnpm1 CVE in this window
  49. 4992@tanstack/solid-router-devtoolsWorst: CVE-2026-45321 @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keysnpm1 CVE in this window
  50. 5092@tanstack/solid-router-ssr-queryWorst: CVE-2026-45321 @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keysnpm1 CVE in this window

Do you depend on one of these? Scan your lockfile.