Feed live

The CMS vulnerability ledger.

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

335,499

All time

Critical · Active

10,538

CVSS ≥ 9.0

New · 14 days

707

Newly disclosed

Feed last synced

4 hrs ago

Data freshness

Showing 1–17 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-11417	high	7.3/10	OS Command Injection in NodejsFunction Bundling in aws-cdk-lib	Jun 10, 2026 16d ago
CVE-2026-46357	medium	6.5/10	HAX CMS NodeJS application Vulnerable to Denial of Service using Malicious Import Request	Jun 5, 2026 21d ago
CVE-2026-33872	high	7.1/10	elixir-nodejs has Cross-User Data Leakage or Information Disclosure due to Worker Protocol Race Condition	Mar 27, 2026 3mo ago
CVE-2025-54137	high	7.3/10	NodeJS version of the HAX CMS application is distributed with Default Secrets	Jul 22, 2025 11mo ago
CVE-2025-54134	high	7.1/10	HAX CMS NodeJs's Improper Error Handling Leads to Denial of Service	Jul 21, 2025 11mo ago
CVE-2025-54128	high	7.2/10	HAX CMS NodeJs's Disabled Content Security Policy Enables Cross-Site Scripting	Jul 21, 2025 11mo ago
CVE-2025-53642	medium	4.8/10	haxcms-nodejs and haxcms-php Improperly Terminate Sessions	Jul 11, 2025 11mo ago
CVE-2025-49139	medium	5.3/10	@haxtheweb/haxcms-nodejs Iframe Phishing vulnerability	Jun 9, 2025 1y ago
CVE-2025-46328	low	3.3/10	NodeJS Driver for Snowflake has race condition when checking access to Easy Logging configuration file	Apr 28, 2025 1y ago
CVE-2025-24791	medium	4.4/10	snowflake-connector-nodejs has incorrect validation of temporary credential cache file permissions	Jan 29, 2025 1y ago
CVE-2023-6460	medium	4.0/10	Information leak in nodejs-firestore	Dec 4, 2023 2y ago
CVE-2023-34232	high	7.3/10	Snowflake NodeJS Driver vulnerable to Command Injection	Jun 8, 2023 3y ago
CVE-2023-23936	medium	6.5/10	CRLF Injection in Nodejs ‘undici’ via host	Feb 16, 2023 3y ago
CVE-2022-35948	medium	5.3/10	CRLF Injection in Nodejs ‘undici’ via Content-Type	Aug 13, 2022 3y ago
CVE-2022-36127	—	—	Service unavailability impact in NodeJS agent(version <= 0.5.0)	Jul 18, 2022 3y ago
CVE-2021-3777	high	7.5/10	Inefficient Regular Expression Complexity in daaku/nodejs-tmpl	Sep 15, 2021 4y ago
CVE-2021-21413	high	8.0/10	Misuse of `Reference` and other transferable APIs may lead to access to nodejs isolate	Mar 30, 2021 5y ago