Package Vulnerabilities by Ecosystem
11,917 CVE-affected open-source packages across 11 ecosystems, ranked by live CVE volume — 44,769 package-to-CVE mappings sourced from GHSA, NVD, and vendor advisories, with affected ranges and fixed versions. Each package links to its live CVE list, updated continuously as new vulnerabilities publish.
Java / JVM artifacts
Top 8 by CVE volume
- 1.org.jenkins-ci.main:jenkins-core259 CVEs
- 2.org.apache.tomcat:tomcat164 CVEs
- 3.com.liferay.portal:release.portal.bom159 CVEs
- 4.com.liferay.portal:release.dxp.bom125 CVEs
- 5.org.keycloak:keycloak-services97 CVEs
- 6.com.fasterxml.jackson.core:jackson-databind85 CVEs
- 7.org.apache.tomcat.embed:tomcat-embed-core78 CVEs
- 8.org.apache.struts:struts2-core60 CVEs
JavaScript / Node.js packages
Top 8 by CVE volume
- 1.openclaw531 CVEs
- 2.n8n156 CVEs
- 3.parse-server117 CVEs
- 4.flowise112 CVEs
- 5.electron79 CVEs
- 6.vm278 CVEs
- 7.ghost69 CVEs
- 8.next65 CVEs
Python packages
Top 8 by CVE volume
- 1.tensorflow427 CVEs
- 2.tensorflow-cpu424 CVEs
- 3.tensorflow-gpu421 CVEs
- 4.django162 CVEs
- 5.apache-airflow158 CVEs
- 6.open-webui148 CVEs
- 7.pillow112 CVEs
- 8.praisonai106 CVEs
Go modules
Top 8 by CVE volume
- 1.github.com/mattermost/mattermost-server296 CVEs
- 2.github.com/mattermost/mattermost-server/v6222 CVEs
- 3.github.com/mattermost/mattermost/server/v8207 CVEs
- 4.github.com/mattermost/mattermost-server/v5199 CVEs
- 5.stdlib183 CVEs
- 6.code.gitea.io/gitea121 CVEs
- 7.github.com/siyuan-note/siyuan/kernel105 CVEs
- 8.github.com/usememos/memos74 CVEs
PHP / Composer packages
Top 8 by CVE volume
- 1.moodle/moodle437 CVEs
- 2.magento/community-edition353 CVEs
- 3.magento/project-community-edition161 CVEs
- 4.wwbn/avideo142 CVEs
- 5.pimcore/pimcore129 CVEs
- 6.craftcms/cms127 CVEs
- 7.dolibarr/dolibarr125 CVEs
- 8.drupal/core120 CVEs
Rust crates
Top 8 by CVE volume
- 1.wasmtime59 CVEs
- 2.coreutils44 CVEs
- 3.surrealdb37 CVEs
- 4.deno36 CVEs
- 5.openssl-src26 CVEs
- 6.zebrad26 CVEs
- 7.russh23 CVEs
- 8.rusqlite15 CVEs
.NET packages
Top 8 by CVE volume
- 1.Microsoft.ChakraCore247 CVEs
- 2.Magick.NET-Q16-AnyCPU161 CVEs
- 3.Magick.NET-Q16-HDRI-AnyCPU161 CVEs
- 4.Magick.NET-Q8-AnyCPU161 CVEs
- 5.Magick.NET-Q16-HDRI-x86160 CVEs
- 6.Magick.NET-Q16-x86159 CVEs
- 7.Magick.NET-Q8-x86159 CVEs
- 8.Magick.NET-Q16-arm64157 CVEs
Ruby gems
Top 8 by CVE volume
- 1.actionpack62 CVEs
- 2.rack50 CVEs
- 3.nokogiri43 CVEs
- 4.rubygems-update25 CVEs
- 5.activerecord23 CVEs
- 6.puppet23 CVEs
- 7.activesupport17 CVEs
- 8.publify_core15 CVEs
Elixir / Erlang packages
Top 8 by CVE volume
- 1.ash30 CVEs
- 2.bandit24 CVEs
- 3.ash_authentication21 CVEs
- 4.hackney18 CVEs
- 5.mint14 CVEs
- 6.mpp13 CVEs
- 7.jose9 CVEs
- 8.ash_typescript8 CVEs
Dart / Flutter packages
Top 8 by CVE volume
- 1.archive2 CVEs
- 2.agent_dart1 CVEs
- 3.dio1 CVEs
- 4.dio_http2_adapter1 CVEs
- 5.http1 CVEs
- 6.jose1 CVEs
- 7.personnummer1 CVEs
- 8.pubnub1 CVEs
Swift packages
Top 7 by CVE volume
- 1.github.com/pytorch/executorch6 CVEs
- 2.github.com/apple/swift-nio-http21 CVEs
- 3.github.com/facebook/zstd1 CVEs
- 4.github.com/ionic-team/capacitor-swift-pm1 CVEs
- 5.github.com/mongodb/mongo-swift-driver1 CVEs
- 6.github.com/pubnub/swift1 CVEs
- 7.github.com/shareup/wasm-interpreter-apple1 CVEs
Which of these packages run in YOUR stack?
EchelonGraph inventories your dependencies across clouds and clusters, then correlates every package against live CVE intelligence — affected ranges, fixed versions, and blast radius in one graph.
Book a Demo →