Node

Every one of the 144 is a mark on the map. Named now: 131 to 144, most at risk first.

131. Node.js is vulnerable to a certificate validation bypass in https.Agent via cross-policy TLS session reuseCVE-2026-123877nodejs · CVSS 6.8 · 0.2% likelycovered by CyberSIXT

     CWE-2951 bounty report1 article1 article this week: Node.js fixes HTTP/2 and TLS flaws exposing data and keys

132. A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. This can lead to confidentiality impact…CVE-2026-56847nodejs · CVSS 3.3 · 0.2% likely

     CWE-11191 bounty report

133. A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths. This can lead to confidentiality impact or bypas…CVE-2026-58039nodejs · CVSS 3.3 · 0.2% likely

     CWE-2841 bounty report

134. A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the requested p…CVE-2026-106071nodejs · CVSS 3.6 · 0.2% likely

     CWE-2841 bounty report

135. A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission. This vulnerability affects one suppo…CVE-2026-48936nodejs · CVSS 3.3 · 0.2% likely

     CWE-2841 bounty report

136. A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`. This vulnerability affects all supp…CVE-2026-48935nodejs · CVSS 3.3 · 0.2% likely

     CWE-2761 bounty report

137. A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths…CVE-2026-21711nodejs · CVSS 5.3 · 0.2% likely

     CWE-2841 bounty report

138. Node.js is vulnerable to proxy credential disclosure via ERR_PROXY_INVALID_CONFIG error messagesCVE-2026-123871nodejs · CVSS 6.2 · 0.2% likely

     CWE-209

139. A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions…CVE-2026-21715nodejs · CVSS 3.3 · 0.1% likely

     CWE-7321 bounty report

140. Node.js is vulnerable to a per-host mTLS authorization bypass via a CA-only SNI context failing open to the default CACVE-2026-123867nodejs · CVSS 4.2 · 0.1% likelycovered by CyberSIXT

     CWE-2951 article1 article this week: Node.js fixes HTTP/2 and TLS flaws exposing data and keys

141. Node.js is vulnerable to a zlib denial of service via a stream destroy during a pending params() callCVE-2026-123862nodejs · CVSS 2.9 · 0.1% likely

     CWE-248

142. An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based eq…CVE-2026-21716nodejs · CVSS 3.3 · 0.1% likely

     CWE-8621 bounty report

143. Node.js is vulnerable to Permission Model file-name disclosure via recursive fs.watchCVE-2026-123829nodejs · CVSS 2.5 · 0.1% likely

     CWE-200

144. A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with…CVE-2026-56850nodejs · CVSS 4.1 · 0.1% likely

     CWE-2871 bounty report

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.