Skip to main content
cve.nowby Sazabi
Menu

Rankings

CVEs and the packages they hit, scored 0-100 on exploitation, exposure, reach, severity and patch status. How the score works.

Packages ranked by the score of their worst CVE published or escalated in the last 7 days, then by how many they have.

  1. 185gpustackWorst: CVE-2026-102895 · gpustack: Auth bypass in loopback trust via proxy headersPyPI1 CVE in this window
  2. 266io.netty:netty-codec-http2Worst: CVE-2026-33871 · netty · io.netty:netty-codec-http2: Denial of service in HTTP/2 CONTINUATION handlingMaven1 CVE in this window
  3. 366@graphql-tools/utilsWorst: CVE-2026-114604 · ardatan graphql-tools · @graphql-tools/utils: Prototype pollution in mergeIncrementalResult helpernpm1 CVE in this window
  4. 464PmongooseWorst: CVE-2026-125117 · Automattic mongoose · mongoose: Denial of service via prototype pollution in data mergingnpm3 CVEs in this window
  5. 561Preact-server-dom-parcelWorst: CVE-2026-126187 · react · react-server-dom-parcel +2: Remote code execution in server componentsnpm1 CVE in this window
  6. 661Preact-server-dom-turbopackWorst: CVE-2026-126187 · react · react-server-dom-parcel +2: Remote code execution in server componentsnpm1 CVE in this window
  7. 761Preact-server-dom-webpackWorst: CVE-2026-126187 · react · react-server-dom-parcel +2: Remote code execution in server componentsnpm1 CVE in this window
  8. 860@nuxt/contentWorst: CVE-2026-102650 · nuxt content · @nuxt/content: Denial of service in SQLite query APInpm1 CVE in this window
  9. 960P@signalk/resources-providerWorst: CVE-2026-123807 · signalk-server · @signalk resources-provider +1: Path traversal in resources API exposes JWT secretnpm1 CVE in this window
  10. 1060Psignalk-serverWorst: CVE-2026-123807 · signalk-server · @signalk resources-provider +1: Path traversal in resources API exposes JWT secretnpm1 CVE in this window
  11. 1159monaiWorst: CVE-2026-48705 · Project-MONAI MONAI · monai: Denial of service and data corruption in DICOM parsingPyPI1 CVE in this window
  12. 1258code-graph-ragWorst: CVE-2026-77604 · vitali87 code-graph-rag · code-graph-rag: Path traversal in MCP read_file enables arbitrary file readPyPI2 CVEs in this window
  13. 1358github.com/esm-dev/esm.sh/webWorst: CVE-2026-102657 · esm-dev esm.sh · github.com/esm-dev/esm.sh/web: Arbitrary file read in web.NewHandlerGo1 CVE in this window
  14. 1458org.apache.nifi:nifi-dbcp-baseWorst: CVE-2023-34468 · Apache Software Foundation Apache NiFi · nifi +3: Code injection via H2 in database connection poolsMaven1 CVE in this window
  15. 1558org.apache.nifi:nifi-dbcp-service-narWorst: CVE-2023-34468 · Apache Software Foundation Apache NiFi · nifi +3: Code injection via H2 in database connection poolsMaven1 CVE in this window
  16. 1658org.apache.nifi:nifi-hikari-dbcp-serviceWorst: CVE-2023-34468 · Apache Software Foundation Apache NiFi · nifi +3: Code injection via H2 in database connection poolsMaven1 CVE in this window
  17. 1757rustls-webpkiWorst: CVE-2026-111943 · Go standard library crypto/x509 · stdlib +3: Distrust compromised intermediate certificates in crypto/x509crates.io1 CVE in this window
  18. 1857webpki-root-certsWorst: CVE-2026-111943 · Go standard library crypto/x509 · stdlib +3: Distrust compromised intermediate certificates in crypto/x509crates.io1 CVE in this window
  19. 1957webpki-rootsWorst: CVE-2026-111943 · Go standard library crypto/x509 · stdlib +3: Distrust compromised intermediate certificates in crypto/x509crates.io1 CVE in this window
  20. 2057crypto/x509Worst: CVE-2026-111943 · Go standard library crypto/x509 · stdlib +3: Distrust compromised intermediate certificates in crypto/x509Go1 CVE in this window
  21. 2157stdlibWorst: CVE-2026-111943 · Go standard library crypto/x509 · stdlib +3: Distrust compromised intermediate certificates in crypto/x509Go1 CVE in this window
  22. 2256Ppyload-ngWorst: CVE-2026-123816 · pyload · pyload-ng: Auth bypass in API key validation cachePyPI3 CVEs in this window
  23. 2356org.igniterealtime.openfire:xmppserverWorst: CVE-2024-25420 · org.igniterealtime.openfire:xmppserver: Privilege escalation in admin.authorizedJIDs propertyMaven1 CVE in this window
  24. 2453@modelcontextprotocol/sdkWorst: CVE-2026-111768 · modelcontextprotocol typescript-sdk · @modelcontextproto… +3: Denial of service in HTTP request validationnpm1 CVE in this window
  25. 2553@modelcontextprotocol/serverWorst: CVE-2026-111768 · modelcontextprotocol typescript-sdk · @modelcontextproto… +3: Denial of service in HTTP request validationnpm1 CVE in this window
  26. 2653PmuhammaraWorst: CVE-2026-125107 · julianhille MuhammaraJS · muhammara: Denial of service in LZWDecode filternpm1 CVE in this window
  27. 2752oauthlibWorst: CVE-2026-49272 · oauthlib: Auth bypass in device flow token endpointPyPI1 CVE in this window
  28. 2850gitea.com/gitea/runnerWorst: CVE-2026-73802 · Gitea Runner · gitea.com/gitea/runner: Privilege escalation to host root via container optionsGo1 CVE in this window
  29. 2950geonodeWorst: CVE-2026-33050 · geonode: Command execution in layer name handling of uploaded filesPyPI1 CVE in this window
  30. 3050pillowWorst: CVE-2026-112902 · python-pillow Pillow · pillow: Memory disclosure and crash in libtiff encoderPyPI1 CVE in this window
  31. 3149devalueWorst: CVE-2026-123569 · sveltejs devalue · devalue: Denial of service in sparse array serializationnpm4 CVEs in this window
  32. 3246snowflake-connector-pythonWorst: CVE-2026-123859 · snowflake-connector-python: SQL injection in write_pandas column namesPyPI1 CVE in this window
  33. 3343github.com/kubeflow/pipelinesWorst: CVE-2026-77596 · kubeflow pipelines · github.com/kubeflow/pipelines: Authorization bypass in pipeline API serverGo2 CVEs in this window
  34. 3442hickory-protoWorst: CVE-2026-123608 · hickory-dns · hickory-proto: Denial of service in BinEncoder name compressioncrates.io2 CVEs in this window
  35. 3542PotterdogWorst: CVE-2026-123870 · Eclipse Foundation otterdog: Unauthenticated remote code execution in webhook handlerPyPI2 CVEs in this window
  36. 3642hickory-netWorst: CVE-2026-123607 · hickory-dns · hickory-net +1: Denial of service via loop in DNSSEC NSEC3 validationcrates.io1 CVE in this window
  37. 3742hickory-resolverWorst: CVE-2026-123604 · hickory-dns · hickory-resolver: Resource exhaustion in NameServerPool::try_sendcrates.io1 CVE in this window
  38. 3841github.com/imgproxy/imgproxyWorst: CVE-2026-123616 · imgproxy · github.com/imgproxy/imgproxy +3: Memory exhaustion via unbounded allocation in ICO loaderGo3 CVEs in this window
  39. 3941github.com/imgproxy/imgproxy/v2Worst: CVE-2026-123616 · imgproxy · github.com/imgproxy/imgproxy +3: Memory exhaustion via unbounded allocation in ICO loaderGo3 CVEs in this window
  40. 4041github.com/imgproxy/imgproxy/v3Worst: CVE-2026-123616 · imgproxy · github.com/imgproxy/imgproxy +3: Memory exhaustion via unbounded allocation in ICO loaderGo3 CVEs in this window
  41. 4141github.com/imgproxy/imgproxy/v4Worst: CVE-2026-123616 · imgproxy · github.com/imgproxy/imgproxy +3: Memory exhaustion via unbounded allocation in ICO loaderGo3 CVEs in this window
  42. 4241dcmjsWorst: CVE-2026-46350 · dcmjs-org dcmjs · dcmjs: INPUT validation BYPASS in DICOM DS/IS parsingnpm1 CVE in this window
  43. 4340org.apache.juneau:juneau-marshallWorst: CVE-2026-96677 · Apache Software Foundation org.apache.juneau:juneau-marshall: Cross-site scripting in HTML doc serializer chromeMaven3 CVEs in this window
  44. 4440org.apache.juneau:juneau-rest-serverWorst: CVE-2026-73117 · Apache Software Foundation org.apache.juneau:juneau-rest-se…: Open redirect and header injection in REST server responsesMaven3 CVEs in this window
  45. 4540org.apache.juneau:juneau-rest-commonWorst: CVE-2026-73116 · Apache Software Foundation org.apache.juneau:juneau-rest-cl…: Credential leak via cross-origin redirects in REST clientMaven2 CVEs in this window
  46. 4640org.apache.juneau:juneau-rest-server.Worst: CVE-2026-73101 · Apache Software Foundation org.apache.juneau:juneau-rest-se…: Information disclosure in REST error responsesMaven2 CVEs in this window
  47. 4740gogs.io/gogsWorst: CVE-2026-123012 · Gogs · gogs.io/gogs: In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a…Go1 CVE in this window
  48. 4840axis:axisWorst: CVE-2026-90436 · Apache Software Foundation axis:axis · Apache Software F… +1: Remote class instantiation in SOAP fault parsingMaven1 CVE in this window
  49. 4940org.apache.axis:axisWorst: CVE-2026-90436 · Apache Software Foundation axis:axis · Apache Software F… +1: Remote class instantiation in SOAP fault parsingMaven1 CVE in this window
  50. 5040org.apache.juneau:juneau-commonsWorst: CVE-2026-121489 · Apache Software Foundation org.apache.juneau:juneau-microse…: Path traversal in DirectoryResource exposes filesMaven1 CVE in this window

Do you depend on one of these? Scan your lockfile.