Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
397 results · page 3 of 8
May 11, 2026Path traversal vulnerability exists in GROWI v7.5.0 and earlier, which may allow an attacker to execute arbitrary EJS templates on the server when an email servCVE-2026-41951 · Other software · GROWI, Inc. · reported by vultures@jpcert.or.jpHigh 8.6
Path traversal vulnerability exists in GROWI v7.5.0 and earlier, which may allow an attacker to execute arbitrary EJS templates on the server when an email server is running in GROWI.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2026SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte.CVE-2026-40074 · Other software · sveltejs · reported by GitHubMedium 6.3
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, redirect, when called from inside the handle server hook with a location parameter containing characters that are invalid in a HTTP header, will cause an unhandled TypeError. This could result in DoS on some platforms, especially if the location passed to redirect contains unsanitized user input. This vulnerability is fixed in 2.57.1.
- Product
- kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2026SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte.CVE-2026-40073 · Other software · sveltejs · reported by GitHubHigh 8.2
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, under certain circumstances, requests could bypass the BODY_SIZE_LIMIT on SvelteKit applications running with adapter-node. This bypass does not affect body size limits at other layers of the application stack, so limits enforced in the WAF, gateway, or at the platform level are unaffected. This vulnerability is fixed in 2.57.1.
- Product
- kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026Vite is a frontend tooling framework for JavaScript.CVE-2026-39365 · Other software · vitejs · reported by GitHubMedium 6.3
Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.
- Product
- vite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026Vite is a frontend tooling framework for JavaScript.CVE-2026-39364 · Other software · vitejs · reported by GitHubHigh 8.2
Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended. This vulnerability is fixed in 7.3.2 and 8.0.5.
- Product
- vite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
Apr 7, 2026Vite is a frontend tooling framework for JavaScript.CVE-2026-39363 · Other software · vitejs · reported by GitHubHigh 8.2
Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite:invoke and combine file://... with ?raw (or ?inline) to retrieve the contents of arbitrary files on the server as a JavaScript string (e.g., export default "..."). The access control enforced in the HTTP request path (such as server.fs.allow) is not applied to this WebSocket-based execution path. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.
- Product
- vite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
Apr 6, 2026HAX CMS helps manage microsite universe with PHP or NodeJs backends.CVE-2026-35185 · Other software · haxtheweb · reported by GitHubHigh 8.7
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens (user_token), user activity, client IP addresses, and server configuration details. This allows any unauthenticated user to monitor real-time user interactions and gather internal infrastructure information. This vulnerability is fixed in 25.0.0.
- Product
- HAXiam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable.CVE-2026-21717 · Other software · nodejs · reported by support@hackerone.comMedium 5.9
A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process. The most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table. This vulnerability affects **20.x, 22.x, 24.x, and 25.x**.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while theiCVE-2026-21716 · Other software · nodejs · reported by support@hackerone.comLow 3.3
An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched. As a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions. This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-write` is intentionally restricted.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable fiCVE-2026-21715 · Other software · nodejs · reported by support@hackerone.comLow 3.3
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them. As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories. This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to excCVE-2026-21714 · Other software · nodejs · reported by support@hackerone.comMedium 5.3
A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up. This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportCVE-2026-21713 · Other software · nodejs · reported by support@hackerone.comMedium 5.9
A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values. Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision. This vulnerability affects **20.x, 22.x, 24.x, and 25.x**.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all compaCVE-2026-21711 · Other software · nodejs · reported by support@hackerone.comMedium 5.3
A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary. This vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `CVE-2026-21710 · Other software · nodejs · reported by support@hackerone.comHigh 7.5
A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodejs.orgaccess.redhat.com
Mar 30, 2026A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalized domain name (IDN) cCVE-2026-21712 · Other software · nodejs · reported by support@hackerone.comMedium 6.5
A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js process.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comnodejs.org
Mar 27, 2026elixir-nodejs provides an Elixir API for calling Node.js functions.CVE-2026-33872 · Other software · revelrylabs · reported by GitHubHigh 7.1
elixir-nodejs provides an Elixir API for calling Node.js functions. A vulnerability in versions prior to 3.1.4 results in Cross-User Data Leakage or Information Disclosure due to a race condition in the worker protocol. The lack of request-response correlation creates a "stale response" vulnerability. Because the worker does not verify which request a response belongs to, it may return the next available data in the buffer to an unrelated caller. In high-throughput environments where the library processes sensitive user data (e.g., PII, authentication tokens, or private records), a timeout or high concurrent load can cause Data A (belonging to User A) to be returned to User B. This may lead to unauthorized information disclosure that is difficult to trace, as the application may not throw an error but instead provide "valid-looking" yet entirely incorrect and private data to the wrong session. The issue is fixed in v3.1.4.
- Product
- elixir-nodejs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Keystone is a content management system for Node.js.CVE-2026-33326 · Other software · keystonejs · reported by GitHubMedium 4.3
Keystone is a content management system for Node.js. Prior to version 6.5.2, {field}.isFilterable access control can be bypassed in findMany queries by passing a cursor. This can be used to confirm the existence of records by protected field values. The fix for CVE-2025-46720 (field-level isFilterable bypass for update and delete mutations) added checks to the where parameter in update and delete mutations however the cursor parameter in findMany was not patched and accepts the same UniqueWhere input type. This issue has been patched in version 6.5.2.
- Product
- keystone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job.CVE-2026-30226 · Other software · sveltejs · reported by GitHubMedium 6.3
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In devalue v5.6.3 and earlier, devalue.parse and devalue.unflatten were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Service (DoS) or type confusion. This vulnerability is fixed in 5.6.4.
- Product
- devalue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026Svelte performance oriented web framework.CVE-2026-27902 · Other software · sveltejs · reported by GitHubMedium 5.3
Svelte performance oriented web framework. Prior to version 5.53.5, errors from `transformError` were not correctly escaped prior to being embedded in the HTML output, causing potential HTML injection and XSS if attacker-controlled content is returned from `transformError`. Version 5.53.5 fixes the issue.
- Product
- svelte
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026Svelte performance oriented web framework.CVE-2026-27901 · Other software · sveltejs · reported by GitHubMedium 5.3
Svelte performance oriented web framework. Prior to version 5.53.5, the contents of `bind:innerText` and `bind:textContent` on `contenteditable` elements were not properly escaped. This could enable HTML injection and Cross-Site Scripting (XSS) if rendering untrusted data as the binding's initial value on the server. Version 5.53.5 fixes the issue.
- Product
- svelte
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026TerriaJS-Server is a NodeJS Express server for TerriaJS, a library for building web-based geospatial data explorers.CVE-2026-27818 · Other software · TerriaJS · reported by GitHubHigh 8.7
TerriaJS-Server is a NodeJS Express server for TerriaJS, a library for building web-based geospatial data explorers. A validation bug in versions prior to 4.0.3 allows an attacker to proxy domains not explicitly allowed in the `proxyableDomains` configuration. Version 4.0.3 fixes the issue.
- Product
- terriajs-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026svelte performance oriented web framework.CVE-2026-27125 · Other software · sveltejs · reported by GitHubMedium 5.3
svelte performance oriented web framework. Prior to 5.51.5, in server-side rendering, attribute spreading on elements (e.g. <div {...attrs}>) enumerates inherited properties from the object's prototype chain rather than only own properties. In environments where Object.prototype has already been polluted — a precondition outside of Svelte's control — this can cause unexpected attributes to appear in SSR output or cause SSR to throw errors. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5.
- Product
- svelte
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026svelte performance oriented web framework.CVE-2026-27122 · Other software · sveltejs · reported by GitHubMedium 5.1
svelte performance oriented web framework. Prior to 5.51.5, when using <svelte:element this={tag}> in server-side rendering, the provided tag name is not validated or sanitized before being emitted into the HTML output. If the tag string contains unexpected characters, it can result in HTML injection in the SSR output. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5.
- Product
- svelte
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026svelte performance oriented web framework.CVE-2026-27121 · Other software · sveltejs · reported by GitHubMedium 5.1
svelte performance oriented web framework. Versions of svelte prior to 5.51.5 are vulnerable to cross-site scripting (XSS) during server-side rendering. When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in victims' browsers. This vulnerability is fixed in 5.51.5.
- Product
- svelte
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026svelte performance oriented web framework.CVE-2026-27119 · Other software · sveltejs · reported by GitHubMedium 5.1
svelte performance oriented web framework. From 5.39.3, <=5.51.4, in certain circumstances, the server-side rendering output of an <option> element does not properly escape its content, potentially allowing HTML injection in the SSR output. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5.
- Product
- svelte
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte.CVE-2026-27118 · Other software · sveltejs · reported by GitHubMedium 5.3
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Versions of @sveltejs/adapter-vercel prior to 6.3.2 are vulnerable to cache poisoning. An internal query parameter intended for Incremental Static Regeneration (ISR) is accessible on all routes, allowing an attacker to cause sensitive user-specific responses to be cached and served to other users. Successful exploitation requires a victim to visit an attacker-controlled link while authenticated. Existing deployments are protected by Vercel's WAF, but users should upgrade as soon as possible. This vulnerability is fixed in 6.3.2.
- Product
- kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026TheJshen ContentManagementSystem 1.04 contains a SQL injection vulnerability that allows attackers to manipulate database queries through the 'id' GET parameterCVE-2019-25303 · Other software · thejshen · reported by VulnCheckHigh 7.1
TheJshen ContentManagementSystem 1.04 contains a SQL injection vulnerability that allows attackers to manipulate database queries through the 'id' GET parameter. Attackers can exploit boolean-based, time-based, and UNION-based SQL injection techniques to extract or manipulate database information by crafting malicious query payloads.
- Product
- contentManagementSystem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Feb 6, 2026thejshen Globitek CMS 1.4 contains a SQL injection vulnerability that allows attackers to manipulate database queries through the 'id' GET parameter.CVE-2019-25300 · Other software · thejshen · reported by VulnCheckHigh 7.1
thejshen Globitek CMS 1.4 contains a SQL injection vulnerability that allows attackers to manipulate database queries through the 'id' GET parameter. Attackers can exploit boolean-based, time-based, and UNION-based SQL injection techniques to potentially extract or modify database information.
- Product
- Globitek CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Jan 26, 2026Openfire 4.6.0 contains a stored cross-site scripting vulnerability in the nodejs plugin that allows attackers to inject malicious scripts through the 'path' paCVE-2020-36956 · Other software · igniterealtime · reported by VulnCheckMedium 5.1
Openfire 4.6.0 contains a stored cross-site scripting vulnerability in the nodejs plugin that allows attackers to inject malicious scripts through the 'path' parameter. Attackers can craft a payload with script tags to execute arbitrary JavaScript in the context of administrative users viewing the nodejs configuration page.
- Product
- Openfire
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Jan 20, 2026A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use.CVE-2026-21637 · Other software · nodejs · reported by support@hackerone.comHigh 7.5
A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled.CVE-2026-21636 · Other software · nodejs · reported by support@hackerone.comCritical 10
A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution. * The issue affects users of the Node.js permission model on version v25. In the moment of this vulnerability, network permissions (`--allow-net`) are still in the experimental phase.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabledCVE-2025-59466 · Other software · nodejs · reported by support@hackerone.comHigh 7.5
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`.CVE-2025-59465 · Other software · nodejs · reported by support@hackerone.comHigh 7.5
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example: ``` server.on('secureConnection', socket => { socket.on('error', err => { console.log(err) }) }) ```
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodejs.orgaccess.redhat.com
Jan 20, 2026A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer.CVE-2025-59464 · Other software · nodejs · reported by support@hackerone.comHigh 7.5
A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When applications call `socket.getPeerCertificate(true)`, each certificate field leaks memory, allowing remote clients to trigger steady memory growth through repeated TLS connections. Over time this can lead to resource exhaustion and denial of service.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permisCVE-2025-55132 · Other software · nodejs · reported by support@hackerone.comMedium 5.3
A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout optionCVE-2025-55131 · Other software · nodejs · reported by support@hackerone.comHigh 7.1
A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific timing conditions, buffers allocated with `Buffer.alloc` and other `TypedArray` instances like `Uint8Array` may contain leftover data from previous operations, allowing in-process secrets like tokens or passwords to leak or causing data corruption. While exploitation typically requires precise timing or in-process code execution, it can become remotely exploitable when untrusted input influences workload and timeouts, leading to potential confidentiality and integrity impact.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodejs.orgaccess.redhat.com
Jan 20, 2026A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths.CVE-2025-55130 · Other software · nodejs · reported by support@hackerone.comCritical 9.1
A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodejs.orgaccess.redhat.com
Jan 15, 2026SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte.CVE-2026-22803 · Other software · sveltejs · reported by GitHubHigh 8.2
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From 2.49.0 to 2.49.4, the experimental form remote function uses a binary data format containing a representation of submitted form data. A specially-crafted payload can cause the server to allocate a large amount of memory, causing DoS via memory exhaustion. This vulnerability is fixed in 2.49.5.
- Product
- kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job.CVE-2026-22775 · Other software · sveltejs · reported by GitHubHigh 7.5
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From 5.1.0 to 5.6.1, certain inputs can cause devalue.parse to consume excessive CPU time and/or memory, potentially leading to denial of service in systems that parse input from untrusted sources. This affects applications using devalue.parse on externally-supplied data. The root cause is the ArrayBuffer hydration expecting base64 encoded strings as input, but not checking the assumption before decoding the input. This vulnerability is fixed in 5.6.2.
- Product
- devalue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job.CVE-2026-22774 · Other software · sveltejs · reported by GitHubHigh 7.5
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From 5.3.0 to 5.6.1, certain inputs can cause devalue.parse to consume excessive CPU time and/or memory, potentially leading to denial of service in systems that parse input from untrusted sources. This affects applications using devalue.parse on externally-supplied data. The root cause is the typed array hydration expecting an ArrayBuffer as input, but not checking the assumption before creating the typed array. This vulnerability is fixed in 5.6.2.
- Product
- devalue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte.CVE-2025-67647 · Other software · sveltejs · reported by GitHubHigh 8.4
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.49.5, SvelteKit is vulnerable to a server side request forgery (SSRF) and denial of service (DoS) under certain conditions. From 2.44.0 through 2.49.4, the vulnerability results in a DoS when your app has at least one prerendered route (export const prerender = true). From 2.19.0 through 2.49.4, the vulnerability results in a DoS when your app has at least one prerendered route and you are using adapter-node without a configured ORIGIN environment variable, and you are not using a reverse proxy that implements Host header validation. This vulnerability is fixed in 2.49.5.
- Product
- kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2026Undici is an HTTP/1.1 client for Node.js.CVE-2026-22036 · Other software · nodejs · reported by GitHubMedium 5.9
Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation. This vulnerability is fixed in 7.18.0 and 6.23.0.
- Product
- undici
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2026HAX CMS helps manage microsite universe with PHP or NodeJs backends.CVE-2026-22704 · Other software · haxtheweb · reported by GitHubHigh 8
HAX CMS helps manage microsite universe with PHP or NodeJs backends. In versions 11.0.6 to before 25.0.0, HAX CMS is vulnerable to stored XSS, which could lead to account takeover. This issue has been patched in version 25.0.0.
- Product
- issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2025@vitejs/plugin-rs provides React Server Components (RSC) support for Vite.CVE-2025-68155 · Other software · vitejs · reported by GitHubHigh 7.5
@vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Prior to version 0.5.8, the `/__vite_rsc_findSourceMapURL` endpoint in `@vitejs/plugin-rsc` allows unauthenticated arbitrary file read during development mode. An attacker can read any file accessible to the Node.js process by sending a crafted HTTP request with a `file://` URL in the `filename` query parameter. Version 0.5.8 fixes the issue.
- Product
- vite-plugin-react
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025@vitejs/plugin-rs provides React Server Components (RSC) support for Vite.CVE-2025-67489 · Other software · vitejs · reported by GitHubCritical 9.8
@vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Versions 0.5.5 and below are vulnerable to arbitrary remote code execution on the development server through unsafe dynamic imports in server function APIs (loadServerAction, decodeReply, decodeAction) when integrated into RSC applications that expose server function endpoints. Attackers with network access to the development server can read/modify files, exfiltrate sensitive data (source code, environment variables, credentials), or pivot to other internal services. While this affects development servers only, the risk increases when using vite --host to expose the server on all network interfaces. This issue is fixed in version 0.5.6.
- Product
- vite-plugin-react
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2025Vite is a frontend tooling framework for JavaScript.CVE-2025-62522 · Other software · vitejs · reported by GitHubMedium 6
Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected. This issue has been patched in versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11.
- Product
- vite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025Vite is a frontend tooling framework for JavaScript.CVE-2025-58752 · Other software · vitejs · reported by GitHubLow 2.3
Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, any HTML files on the machine were served regardless of the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or server.host config option) and use `appType: 'spa'` (default) or `appType: 'mpa'` are affected. This vulnerability also affects the preview server. The preview server allowed HTML files not under the output directory to be served. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.
- Product
- vite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025Vite is a frontend tooling framework for JavaScript.CVE-2025-58751 · Other software · vitejs · reported by GitHubLow 2.3
Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public directory were served bypassing the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or `server.host` config option), use the public directory feature (enabled by default), and have a symlink in the public directory are affected. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.
- Product
- vite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025A security vulnerability has been detected in Rejseplanen App up to 8.2.2.CVE-2025-9672 · Other software · reported by VulDBLow 1.9
A security vulnerability has been detected in Rejseplanen App up to 8.2.2. Affected is an unknown function of the file AndroidManifest.xml of the component de.hafas.android.rejseplanen. The manipulation leads to improper export of android application components. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2025Svelte devalue is a utility library.CVE-2025-57820 · Other software · sveltejs · reported by GitHubHigh 7.9
Svelte devalue is a utility library. Prior to version 5.3.2, a string passed to devalue.parse could represent an object with a __proto__ property and devalue.parse does not check that an index is numeric. This could result in assigning prototypes to objects and properties, leading to prototype pollution. This issue has been fixed in version 5.3.2
- Product
- devalue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.