3 actively exploited and 16 urgent items are open, out of 812 open in total.
Last scan started 2026-11-05 05:24:30 UTC, finished OK.
| Vulnerability | Affects | Severity | Exploitation | Fix | Status | |
|---|---|---|---|---|---|---|
| CVE-2026-111497 A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1 |
Node.js 22.16.0 App / API |
Critical 9.8 |
Exploited Fix by 2026-11-10 |
22.23.4, 24.22.1, 26.12.1 | New | |
| CVE-2023-38180 .NET and Visual Studio Denial of Service Vulnerability |
.NET 6 runtime 6.* App / API |
High 7.5 |
Exploited Fix by 2023-08-30 |
6.0.21, 7.0.10 | New | |
| CVE-2023-44487 The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. |
.NET 6 runtime 6.* App / API |
High 7.5 |
Exploited Fix by 2023-10-31 |
6.0.23, 7.0.12 | New | |
| CVE-2025-55315 Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network. |
ASP.NET Core 8 8.* App / API |
Critical 9.9 |
67% chance of exploit in the next 30 days |
8.0.21, 9.0.10 | New | |
| CVE-2023-36049 .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability |
.NET 6 runtime 6.* App / API |
Critical 9.8 |
7% chance of exploit in the next 30 days |
6.0.25, 7.0.14 | New | |
| CVE-2024-0057 NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability |
.NET 6 runtime 6.* App / API |
Critical 9.8 |
3% chance of exploit in the next 30 days |
6.0.26, 7.0.15 | New | |
| GHSA-2464-fhr4-w9xw Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used |
Next.js 16.1.1 App / API |
Critical 9.5 |
No data | 16.4.1 | New | |
| GHSA-2xp9-vwfh-vxw4 Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used |
Next.js 16.1.1 App / API |
Critical 9.5 |
No data | 16.3.3 | New | |
| GHSA-673q-mjm6-r5xr Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays |
Next.js 16.1.1 App / API |
Critical 9.5 |
No data | 16.4.1 | New | |
| CVE-2026-88092 Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network. |
ASP.NET Core 8 8.* App / API |
Critical 9.4 |
1% chance of exploit in the next 30 days |
8.0.32, 9.0.21, 10.0.13 | New | |
| CVE-2026-73420 Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass |
NextAuth.js 4.24.13 App / API |
Critical 9.1 |
1% chance of exploit in the next 30 days |
4.24.15, 5.0.0-beta.32 | New | |
| CVE-2025-55130 A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise.
This vulnerability affects users of the permission model on Node.js v20, |
Node.js 22.16.0 App / API |
Critical 9.1 |
2% chance of exploit in the next 30 days |
22.22.0, 24.13.0, 25.3.0 | New | |
| CVE-2026-75604 Next.js: Unauthenticated Remote Code Execution on windows-hosted servers |
Next.js 16.1.1 App / API |
Critical 9.0 |
2% chance of exploit in the next 30 days |
16.3.3 | New | |
| CVE-2026-44578 Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades |
Next.js 16.1.1 App / API |
High 8.6 |
36% chance of exploit in the next 30 days |
16.2.5 | New | |
| CVE-2021-43803 Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom server. Deployments on Vercel are not affected, along with similar environments where invalid requests are filtered before reaching Next.js. Versions 12.0.5 and 11.1.3 contain patches for this issue. |
Node.js 22.16.0 App / API |
High 7.5 |
47% chance of exploit in the next 30 days |
Not listed | New | |
| CVE-2026-21710 A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`.
When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req |
Node.js 22.16.0 App / API |
High 7.5 |
25% chance of exploit in the next 30 days |
Not listed | New | |
| CVE-2024-0056 Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability |
.NET 6 runtime 6.* App / API |
High 8.7 |
1% chance of exploit in the next 30 days |
6.0.26, 7.0.15 | New | |
| CVE-2026-58043 A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.
Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist.
This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**. |
Node.js 22.16.0 App / API |
High 8.4 |
0% chance of exploit in the next 30 days |
Not listed | New | |
| CVE-2026-64642 Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale |
Next.js 16.1.1 App / API |
High 8.3 |
1% chance of exploit in the next 30 days |
16.2.11 | New | |
| CVE-2026-64649 Next.js: Server-Side Request Forgery in Server Actions on custom servers |
Next.js 16.1.1 App / API |
High 8.3 |
0% chance of exploit in the next 30 days |
16.2.11 | New | |
| CVE-2026-64645 Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname |
Next.js 16.1.1 App / API |
High 8.3 |
0% chance of exploit in the next 30 days |
16.2.11 | New | |
| CVE-2026-64641 Next.js: Denial of Service in App Router using Server Actions |
Next.js 16.1.1 App / API |
High 8.2 |
1% chance of exploit in the next 30 days |
16.2.11 | New | |
| CVE-2026-94482 Next.js: Denial of Service in App Router using Server Actions |
Next.js 16.1.1 App / API |
High 8.2 |
0% chance of exploit in the next 30 days |
16.4.1 | New | |
| CVE-2026-48617 A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**. |
Node.js 22.16.0 App / API |
High 8.2 |
0% chance of exploit in the next 30 days |
Not listed | New | |
| CVE-2026-44574 Next.js has a Middleware / Proxy bypass through dynamic route parameter injection |
Next.js 16.1.1 App / API |
High 8.1 |
1% chance of exploit in the next 30 days |
16.2.5 | New | |
| CVE-2023-33127 .NET and Visual Studio Elevation of Privilege Vulnerability |
.NET 6 runtime 6.* App / API |
High 8.1 |
2% chance of exploit in the next 30 days |
6.0.20, 7.0.9 | New | |
| CVE-2023-33170 ASP.NET and Visual Studio Security Feature Bypass Vulnerability |
.NET 6 runtime 6.* App / API |
High 8.1 |
2% chance of exploit in the next 30 days |
6.0.20, 7.0.9 | New | |
| CVE-2022-41032 NuGet Client Elevation of Privilege Vulnerability |
.NET 6 runtime 6.* App / API |
High 7.8 |
1% chance of exploit in the next 30 days |
Not listed | New | |
| CVE-2023-21808 .NET and Visual Studio Remote Code Execution Vulnerability |
.NET 6 runtime 6.* App / API |
High 7.8 |
1% chance of exploit in the next 30 days |
Not listed | New | |
| CVE-2023-28260 .NET DLL Hijacking Remote Code Execution Vulnerability |
.NET 6 runtime 6.* App / API |
High 7.8 |
2% chance of exploit in the next 30 days |
6.0.16, 7.0.5 | New | |
| CVE-2023-24895 .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability |
.NET 6 runtime 6.* App / API |
High 7.8 |
1% chance of exploit in the next 30 days |
Not listed | New | |
| CVE-2023-24897 .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability |
.NET 6 runtime 6.* App / API |
High 7.8 |
1% chance of exploit in the next 30 days |
Not listed | New | |
| CVE-2023-35390 .NET and Visual Studio Remote Code Execution Vulnerability |
.NET 6 runtime 6.* App / API |
High 7.8 |
2% chance of exploit in the next 30 days |
6.0.21, 7.0.10 | New | |
| CVE-2023-36792 Visual Studio Remote Code Execution Vulnerability |
.NET 6 runtime 6.* App / API |
High 7.8 |
1% chance of exploit in the next 30 days |
Not listed | New | |
| CVE-2023-36793 Visual Studio Remote Code Execution Vulnerability |
.NET 6 runtime 6.* App / API |
High 7.8 |
1% chance of exploit in the next 30 days |
Not listed | New | |
| CVE-2023-36794 Visual Studio Remote Code Execution Vulnerability |
.NET 6 runtime 6.* App / API |
High 7.8 |
1% chance of exploit in the next 30 days |
Not listed | New | |
| CVE-2023-36796 Visual Studio Remote Code Execution Vulnerability |
.NET 6 runtime 6.* App / API |
High 7.8 |
1% chance of exploit in the next 30 days |
Not listed | New | |
| CVE-2026-44575 Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes |
Next.js 16.1.1 App / API |
High 7.5 |
2% chance of exploit in the next 30 days |
16.2.5 | New | |
| CVE-2026-45109 Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up |
Next.js 16.1.1 App / API |
High 7.5 |
1% chance of exploit in the next 30 days |
16.2.6 | New | |
| CVE-2026-44573 Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n |
Next.js 16.1.1 App / API |
High 7.5 |
1% chance of exploit in the next 30 days |
16.2.5 | New | |
| GHSA-8h8q-6873-q5fj Next.js Vulnerable to Denial of Service with Server Components |
Next.js 16.1.1 App / API |
High 7.5 |
No data | 16.2.5 | New | |
| GHSA-h25m-26qc-wcjf Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components |
Next.js 16.1.1 App / API |
High 7.5 |
No data | 16.1.5 | New | |
| CVE-2026-44579 Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components |
Next.js 16.1.1 App / API |
High 7.5 |
1% chance of exploit in the next 30 days |
16.2.5 | New | |
| GHSA-q4gf-8mx6-v5v3 Next.js has a Denial of Service with Server Components |
Next.js 16.1.1 App / API |
High 7.5 |
No data | 16.2.3 | New | |
| CVE-2026-73418 Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers |
NextAuth.js 4.24.13 App / API |
High 7.5 |
1% chance of exploit in the next 30 days |
4.24.15, 5.0.0-beta.32 | New | |
| CVE-2022-21986 .NET Denial of Service Vulnerability |
.NET 6 runtime 6.* App / API |
High 7.5 |
4% chance of exploit in the next 30 days |
6.0.2 | New | |
| CVE-2022-24464 .NET and Visual Studio Denial of Service Vulnerability |
.NET 6 runtime 6.* App / API |
High 7.5 |
4% chance of exploit in the next 30 days |
Not listed | New | |
| CVE-2022-23267 .NET and Visual Studio Denial of Service Vulnerability |
.NET 6 runtime 6.* App / API |
High 7.5 |
6% chance of exploit in the next 30 days |
Not listed | New | |
| CVE-2022-29117 .NET and Visual Studio Denial of Service Vulnerability |
.NET 6 runtime 6.* App / API |
High 7.5 |
6% chance of exploit in the next 30 days |
Not listed | New | |
| CVE-2022-29145 .NET and Visual Studio Denial of Service Vulnerability |
.NET 6 runtime 6.* App / API |
High 7.5 |
6% chance of exploit in the next 30 days |
Not listed | New | |
| CVE-2022-38013 .NET Core and Visual Studio Denial of Service Vulnerability |
.NET 6 runtime 6.* App / API |
High 7.5 |
4% chance of exploit in the next 30 days |
Not listed | New | |
| CVE-2023-21538 .NET Denial of Service Vulnerability |
.NET 6 runtime 6.* App / API |
High 7.5 |
3% chance of exploit in the next 30 days |
Not listed | New | |
| CVE-2023-24936 .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability |
.NET 6 runtime 6.* App / API |
High 7.5 |
2% chance of exploit in the next 30 days |
Not listed | New | |
| CVE-2023-29331 .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability |
.NET 6 runtime 6.* App / API |
High 7.5 |
3% chance of exploit in the next 30 days |
Not listed | New | |
| CVE-2023-38178 .NET Core and Visual Studio Denial of Service Vulnerability |
.NET 6 runtime 6.* App / API |
High 7.5 |
3% chance of exploit in the next 30 days |
Not listed | New | |
| CVE-2023-35391 ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability |
.NET 6 runtime 6.* App / API |
High 7.5 |
2% chance of exploit in the next 30 days |
6.0.21, 7.0.10 | New | |
| CVE-2024-20672 .NET Denial of Service Vulnerability |
.NET 6 runtime 6.* App / API |
High 7.5 |
3% chance of exploit in the next 30 days |
6.0.26, 7.0.15 | New | |
| CVE-2024-43483 .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability |
.NET 6 runtime 6.* App / API |
High 7.5 |
3% chance of exploit in the next 30 days |
6.0.35, 8.0.10 | New | |
| CVE-2024-43484 .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability |
.NET 6 runtime 6.* App / API |
High 7.5 |
3% chance of exploit in the next 30 days |
6.0.35, 8.0.10 | New | |
| CVE-2024-43485 .NET and Visual Studio Denial of Service Vulnerability |
.NET 6 runtime 6.* App / API |
High 7.5 |
3% chance of exploit in the next 30 days |
6.0.35, 8.0.10 | New | |
| CVE-2023-36038 ASP.NET Core Denial of Service Vulnerability |
ASP.NET Core 8 8.* App / API |
High 7.5 |
3% chance of exploit in the next 30 days |
Not listed | New | |
| CVE-2024-21386 .NET Denial of Service Vulnerability |
ASP.NET Core 8 8.* App / API |
High 7.5 |
2% chance of exploit in the next 30 days |
8.0.2 | New | |
| CVE-2024-21404 .NET Denial of Service Vulnerability |
ASP.NET Core 8 8.* App / API |
High 7.5 |
3% chance of exploit in the next 30 days |
8.0.2 | New | |
| CVE-2025-26682 Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
ASP.NET Core 8 8.* App / API |
High 7.5 |
2% chance of exploit in the next 30 days |
8.0.15, 9.0.4 | New | |
| CVE-2026-26130 Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
ASP.NET Core 8 8.* App / API |
High 7.5 |
3% chance of exploit in the next 30 days |
8.0.25, 9.0.14, 10.0.4 | New | |
| CVE-2026-45591 Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
ASP.NET Core 8 8.* App / API |
High 7.5 |
2% chance of exploit in the next 30 days |
8.0.28, 9.0.17, 10.0.9 | New | |
| CVE-2025-59465 A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:
```
server.on('secureConnection', socket => {
socket.on('error', err => {
console.log(err)
})
})
``` |
Node.js 22.16.0 App / API |
High 7.5 |
4% chance of exploit in the next 30 days |
22.22.0, 24.13.0, 25.3.0 | New | |
| CVE-2025-59466 We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions. |
Node.js 22.16.0 App / API |
High 7.5 |
1% chance of exploit in the next 30 days |
22.22.0, 24.13.0, 25.3.0 | New | |
| CVE-2026-21637 A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client ca |
Node.js 22.16.0 App / API |
High 7.5 |
1% chance of exploit in the next 30 days |
22.22.0, 24.13.0, 25.3.0 | New | |
| CVE-2026-48937 A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This vulnerability affects two supported release lines: **Node.js 22** and **Node.js 24**. |
Node.js 22.16.0 App / API |
High 7.5 |
1% chance of exploit in the next 30 days |
22.23.0, 24.17.0 | New | |
| CVE-2023-33126 .NET and Visual Studio Remote Code Execution Vulnerability |
.NET 6 runtime 6.* App / API |
High 7.3 |
1% chance of exploit in the next 30 days |
6.0.18, 7.0.7 | New | |
| CVE-2023-33128 .NET and Visual Studio Remote Code Execution Vulnerability |
.NET 6 runtime 6.* App / API |
High 7.3 |
1% chance of exploit in the next 30 days |
6.0.18, 7.0.7 | New | |
| CVE-2023-33135 .NET and Visual Studio Elevation of Privilege Vulnerability |
.NET 6 runtime 6.* App / API |
High 7.3 |
1% chance of exploit in the next 30 days |
6.0.18, 7.0.7 | New | |
| CVE-2024-21409 .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability |
.NET 6 runtime 6.* App / API |
High 7.3 |
3% chance of exploit in the next 30 days |
6.0.29, 7.0.18, 8.0.4 | New | |
| CVE-2024-38081 .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability |
.NET 6 runtime 6.* App / API |
High 7.3 |
1% chance of exploit in the next 30 days |
6.0.32 | New | |
| CVE-2025-24070 Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a network. |
ASP.NET Core 8 8.* App / API |
High 7.0 |
1% chance of exploit in the next 30 days |
8.0.14, 9.0.3 | New | |
| CVE-2026-94483 Next.js has Server-Side Request Forgery in Image Optimization |
Next.js 16.1.1 App / API |
High 6.5 |
0% chance of exploit in the next 30 days |
16.3.8 | New |