CVE Tools
Track your stack

Open Source Libraries

52,679 CVEs tracked since 1999. In the last 12 months, 12,592, +145% on the 12 before.

Open Source Libraries by subsector, Oct 2026 so far

Oct 2026 so far: 1,377 CVEs across 9 subsectors. Area is each subsector's share; inside are the products it counted most. Point at one to read it.
  • Other libraries73553% · 140 vendors
  • Not yet sub-classified329The tagger has not placed these yet
  • Web frameworks1209% · 44 vendors
  • PyPI957% · 7 vendors
  • npm625% · 15 vendors

Also: Go modules 22, crates.io 9, Maven 4, NuGet 1.

Month by month

Every monthly snapshot of Open Source Libraries. A column is the CVEs published that month.

Oct 2021 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Open Source Libraries CVEs per month
MonthCVEs
2021-10241
2021-11340
2021-12364
2022-01545
2022-02457
2022-03482
2022-04352
2022-05412
2022-06540
2022-07374
2022-08402
2022-09552
2022-10348
2022-11438
2022-12510
2023-01403
2023-02417
2023-030
2023-04448
2023-05381
2023-06413
2023-07361
2023-08448
2023-09399
2023-10405
2023-11377
2023-12438
2024-01433
2024-02494
2024-03447
2024-04431
2024-05719
2024-06437
2024-07394
2024-08313
2024-09361
2024-10432
2024-11389
2024-12320
2025-01351
2025-02347
2025-03623
2025-04466
2025-05369
2025-06420
2025-07434
2025-08496
2025-09487
2025-10543
2025-11369
2025-12550
2026-01842
2026-021015
2026-031600
2026-041120
2026-051175
2026-061513
2026-071337
2026-081308
2026-091220
2026-101377

Vendors

Who shipped the most Open Source Libraries CVEs in Oct 2026 so far, with their rank across all vendors.

  1. Eclipse Foundation78#14
  2. Imagemagick70#18
  3. Freerdp69#19
  4. npm38#36
  5. Python-pillow38#37
  6. Bouncycastle37#38
  7. PyPI37#41
  8. Go36#43

Weaknesses

The weakness classes behind Open Source Libraries CVEs in Oct 2026 so far.

  1. CWE-125 Out-of-bounds Read88
  2. CWE-79 XSS66
  3. CWE-22 Path Traversal52
  4. CWE-863 Incorrect Authorization40
  5. CWE-200 Information Exposure36
  6. CWE-284 Improper Access Control31

Latest CVEs

The 15 most recently published vulnerabilities in Open Source Libraries.

  1. CVE-2026-91920Undertow: undertow: chunkreader message length permits chunk-size overflow6.5
  2. CVE-2026-119285Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads5.9
  3. CVE-2026-119284joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection—
  4. CVE-2026-119283joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption7.5
  5. CVE-2026-119282Nx: OS command injection via nx.json plugin options in @nx/maven and @nx/gradle—
  6. CVE-2026-119209pypdf: Possible large memory usage when parsing cross-reference streams—
  7. CVE-2026-119208pypdf: Possible long runtimes/large memory usage for encrypted PDF files—
  8. CVE-2026-119207pypdf: Possible large memory usage for exceptions in strict mode—
  9. CVE-2026-119206pypdf: Possible long runtimes when retrieving page labels—
  10. CVE-2026-119205pypdf: Possible infinite loop when cloning dictionaries—
  11. CVE-2026-119204pypdf: Possible large memory usage when parsing page tree—
  12. CVE-2026-119203pypdf: Possible infinite loop when hitting EOF in standard xref table during trailer search—
  13. CVE-2026-119202@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service7.5
  14. CVE-2026-119201Nuxt dev server exposes generated appSecret through Vite file serving4.8
  15. CVE-2026-119200Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes6.5

The record

Busiest month
Mar 2026, 1,600 CVEs
Oct 2026 so far
1,377 CVEs from 250 vendors
Deployment
Library, 78%
Monthly snapshots
291 since 1999
All 15 sectors on one map

Is your business exposed to threats like these?

Discuss a security assessment of your internet-facing systems. Scope, price and timing agreed before testing.

Request an assessment