Log in Start free

CycloneDX

Products

ProductCVEsExploitedLatest
cyclonedx-core-java2–Nov 10, 2025
cyclonedx-node-npm2–Sep 17, 2026
cyclonedx-bom-repo-server1–Mar 22, 2022
cyclonedx-javascript-library1–May 9, 2024

Exploited and recent CVEs

  • CVE-2026-71538 High 8.5 @cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows 0.2%
  • CVE-2026-55849 High 8.5 @cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized `--workspace` Argument 0.2%
  • CVE-2025-64518 High 7.5 CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection 0.4%
  • CVE-2024-38374 High 7.5 Improper Restriction of XML External Entity Reference in org.cyclonedx:cyclonedx-core-java 0.6%
  • CVE-2024-34345 High 8.1 @cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability 0.9%
  • CVE-2022-24774 High 7.1 Improper Input Validation leading to Path Traversal in CycloneDX BOM Repository Server 1.5%