Quickjs

Every one of the 15 is a mark on the map. Named now: 1 to 15, most at risk first.

1. Buffer Overflow vulnerability in quickjs.c in QuickJS, allows remote attackers to cause denial of service. This issue is resolved in the 2020-07-05 release.CVE-2020-22876Quickjs Project · 1.6% likely

   CWE-120

2. QuickJS commit 2788d71 was discovered to contain a stack-overflow via the component js_proxy_isArray at quickjs.c.CVE-2023-31922Quickjs Project · CVSS 7.5 · 0.7% likely

   CWE-787

3. QuickJS before c4cdd61 has a build_for_in_iterator NULL pointer dereference because of an erroneous lexical scope of "this" with eval.CVE-2023-48183Quickjs Project · CVSS 7.5 · 0.6% likely

   CWE-476

4. Type confusion in string addition in QuickJSCVE-2025-62494QuickJS · CVSS 7.1 · 0.5% likely

   CWE-704

5. Integer overflow in js_bigint_from_string in QuickJSCVE-2025-62496QuickJS · CVSS 7.1 · 0.5% likely

   CWE-190

6. Type confusion in string addition in QuickJSCVE-2025-62495QuickJS · CVSS 7.1 · 0.5% likely

   CWE-191

7. Use-after-free in js_std_promise_rejection_check in QuickJSCVE-2025-62491QuickJS · CVSS 8.8 · 0.4% likely

   CWE-416

8. Use-after-free in js_print_object in QuickJSCVE-2025-62490QuickJS · CVSS 8.8 · 0.4% likely

   CWE-416

9. Heap out-of-bounds read in js_typed_array_indexOf in QuickJSCVE-2025-62492QuickJS · CVSS 5.9 · 0.4% likely

   CWE-125

10. Heap out-of-bounds read in js_bigint_to_string1 in QuickJSCVE-2025-62493QuickJS · CVSS 5.9 · 0.4% likely

    CWE-125

11. QuickJS before 7414e5f has a quickjs.h JS_FreeValueRT use-after-free because of incorrect garbage collection of async functions with closures.CVE-2023-48184Quickjs Project · CVSS 3.9 · 0.3% likely

    CWE-416

12. A crafted JavaScript input executed with the QuickJS release 2025-09-13, fixed in commit fcd33c1afa7b3028531f53cd1190a3877454f6b3 (2025-12-11),`qjs` interpreter using the `-m` opt…CVE-2025-69654Quickjs Project · CVSS 7.5 · 0.3% likely

    CWE-400

13. quickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is also affected.CVE-2025-46688QuickJS Project · CVSS 5.6 · 0.3% likely

    CWE-131

14. quickjs-ng through 0.9.0 has a missing length check in JS_ReadString for a string, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is also affected.CVE-2025-46687QuickJS Project · CVSS 5.6 · 0.3% likely

    CWE-770

15. A crafted JavaScript input can trigger an internal assertion failure in QuickJS release 2025-09-13, fixed in commit 1dbba8a88eaa40d15a8a9b70bb1a0b8fb5b552e6 (2025-12-11), in file…CVE-2025-69653Quickjs Project · CVSS 6.5 · 0.3% likely

    CWE-617

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.