Skip to main content
cve.nowby Sazabi
Rankings

Rankings: All-time worst packages

Open source packages ranked by the score of their worst CVE published or escalated in the window, then by how many they have. How the score works.

  1. 192electronWorst: CVE-2022-4135 · Google Chrome · electron: Sandbox escape via heap overflow in GPU componentnpm19 CVEs in this window
  2. 292react-server-dom-parcelWorst: CVE-2025-55182 · Meta react-server-dom-webpack · Meta react-server-dom-tu… +4: Pre-auth remote code execution in server function endpointsnpm8 CVEs in this window
  3. 392react-server-dom-turbopackWorst: CVE-2025-55182 · Meta react-server-dom-webpack · Meta react-server-dom-tu… +4: Pre-auth remote code execution in server function endpointsnpm8 CVEs in this window
  4. 492react-server-dom-webpackWorst: CVE-2025-55182 · Meta react-server-dom-webpack · Meta react-server-dom-tu… +4: Pre-auth remote code execution in server function endpointsnpm8 CVEs in this window
  5. 592CefSharp.CommonWorst: CVE-2020-15999 · Google Chrome · CefSharp.Common +3: Heap buffer overflow in FreeType font renderingNuGet5 CVEs in this window
  6. 692CefSharp.WinFormsWorst: CVE-2020-15999 · Google Chrome · CefSharp.Common +3: Heap buffer overflow in FreeType font renderingNuGet5 CVEs in this window
  7. 792CefSharp.WpfWorst: CVE-2020-15999 · Google Chrome · CefSharp.Common +3: Heap buffer overflow in FreeType font renderingNuGet5 CVEs in this window
  8. 892CefSharp.Wpf.HwndHostWorst: CVE-2020-15999 · Google Chrome · CefSharp.Common +3: Heap buffer overflow in FreeType font renderingNuGet5 CVEs in this window
  9. 992starletteWorst: CVE-2026-48710 · Kludex starlette · starlette: Security check bypass via unvalidated Host headerPyPI3 CVEs in this window
  10. 1092org.apache.logging.log4j:log4j-coreWorst: CVE-2021-44228 · Apache Software Foundation Apache Log4j2 · org.apache.lo… +4: Remote code execution in JNDI lookupsMaven2 CVEs in this window
  11. 1192org.ops4j.pax.logging:pax-logging-log4j2Worst: CVE-2021-44228 · Apache Software Foundation Apache Log4j2 · org.apache.lo… +4: Remote code execution in JNDI lookupsMaven2 CVEs in this window
  12. 1292@tanstack/react-startWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm2 CVEs in this window
  13. 1392@tanstack/solid-startWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm2 CVEs in this window
  14. 1492@tanstack/start-server-coreWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm2 CVEs in this window
  15. 1592@tanstack/vue-startWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm2 CVEs in this window
  16. 1692github.com/andybalholm/brotliWorst: CVE-2026-111497 · Google Brotli · node +7: Out-of-bounds write in decompression decoderGo1 CVE in this window
  17. 1792com.guicedee.services:log4j-coreWorst: CVE-2021-44228 · Apache Software Foundation Apache Log4j2 · org.apache.lo… +4: Remote code execution in JNDI lookupsMaven1 CVE in this window
  18. 1892org.xbib.elasticsearch:log4jWorst: CVE-2021-44228 · Apache Software Foundation Apache Log4j2 · org.apache.lo… +4: Remote code execution in JNDI lookupsMaven1 CVE in this window
  19. 1992uk.co.nichesolutions.logging.log4j:log4j-coreWorst: CVE-2021-44228 · Apache Software Foundation Apache Log4j2 · org.apache.lo… +4: Remote code execution in JNDI lookupsMaven1 CVE in this window
  20. 2092@tanstack/arktype-adapterWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  21. 2192@tanstack/eslint-plugin-routerWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  22. 2292@tanstack/eslint-plugin-startWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  23. 2392@tanstack/historyWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  24. 2492@tanstack/nitro-v2-vite-pluginWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  25. 2592@tanstack/react-routerWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  26. 2692@tanstack/react-router-devtoolsWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  27. 2792@tanstack/react-router-ssr-queryWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  28. 2892@tanstack/react-start-clientWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  29. 2992@tanstack/react-start-rscWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  30. 3092@tanstack/react-start-serverWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  31. 3192@tanstack/router-cliWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  32. 3292@tanstack/router-coreWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  33. 3392@tanstack/router-devtoolsWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  34. 3492@tanstack/router-devtools-coreWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  35. 3592@tanstack/router-generatorWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  36. 3692@tanstack/router-pluginWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  37. 3792@tanstack/router-ssr-query-coreWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  38. 3892@tanstack/router-utilsWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  39. 3992@tanstack/router-vite-pluginWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  40. 4092@tanstack/solid-routerWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  41. 4192@tanstack/solid-router-devtoolsWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  42. 4292@tanstack/solid-router-ssr-queryWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  43. 4392@tanstack/solid-start-clientWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  44. 4492@tanstack/solid-start-serverWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  45. 4592@tanstack/start-client-coreWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  46. 4692@tanstack/start-fn-stubsWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  47. 4792@tanstack/start-plugin-coreWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  48. 4892@tanstack/start-static-server-functionsWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  49. 4992@tanstack/start-storage-contextWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  50. 5092@tanstack/valibot-adapterWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window

Do you depend on one of these? Scan your lockfile.