Login Request a demo
DE
Vendor
denoland
2 products with CVEs on record
39
CVEs
0
On KEV
1
New 30D
Products
DE
deno
denoland
9.8
37 CVEs0 on KEV1 new
ST
std
denoland
7.3
2 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-103473
DE
deno
denoland
8.1
1%
Sep 30Deno 2.7.0 through 2.9.7 Command Injection via node:child_process
CVE-2026-55517
DE
deno
denoland
4.3
0%
Jun 23Deno: Denial of service via non-ASCII bytes in WebSocket response headers
CVE-2026-44726
DE
deno
denoland
9.1
0%
Jun 23Deno: TLS retry copies stale upgrade hook, risking plaintext traffic
CVE-2026-49401
DE
deno
denoland
8.4
0%
Jun 23Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)
CVE-2026-49402
DE
deno
denoland
8.1
0%
Jun 23Deno: Command Injection via spawnSync & spawn on Windows
CVE-2026-49406
DE
deno
denoland
5.5
0%
Jun 23Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions
CVE-2026-49411
DE
deno
denoland
6.5
0%
Jun 23Deno Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks
CVE-2026-49983
DE
deno
denoland
5.2
0%
Jun 23Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access
CVE-2026-49860
DE
deno
denoland
5.2
0%
Jun 23Deno: WebSocket API sandbox bypass via missing post-DNS check
CVE-2026-49859
DE
deno
denoland
5.2
0%
Jun 23Deno: `fetch()` API sandbox bypass via missing DNS resolution check
CVE-2026-49440
DE
deno
denoland
7.4
0%
Jun 23Deno: Miller-Rabin Primality Test Allows Zero Rounds
CVE-2026-32260
DE
deno
denoland
9.8
2%
Mar 12Command Injection via incomplete shell metacharacter blocklist in node:child_process (bypass of CVE-2026-27190 fix)
CVE-2026-27190
DE
deno
denoland
9.8
2%
Feb 20Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process
CVE-2026-22864
DE
deno
denoland
9.8
1%
Jan 15Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass
CVE-2026-22863
DE
deno
denoland
7.5
0%
Jan 15Deno node:crypto doesn't finalize cipher
CVE-2025-61787
DE
deno
denoland
8.1
2%
Oct 8Deno is Vulnerable to Command Injection on Windows During Batch File Execution
CVE-2025-61786
DE
deno
denoland
3.3
0%
Oct 8Deno's --deny-read check does not prevent permission bypass
CVE-2025-61785
DE
deno
denoland
3.3
0%
Oct 8Deno's --deny-write check does not prevent permission bypass
CVE-2025-55195
ST
std
denoland
7.3
0%
Aug 14@std/toml Prototype Pollution in Node.js and Browser
CVE-2025-48935
DE
deno
denoland
9.1
0%
Jun 4Deno has --allow-read / --allow-write permission bypass in `node:sqlite`
CVE-2025-48934
DE
deno
denoland
5.3
0%
Jun 4Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables
CVE-2025-48888
DE
deno
denoland
5.3
0%
Jun 4Deno run with --allow-read and --deny-read flags results in allowed
CVE-2025-24015
DE
deno
denoland
5.3
0%
Jun 3Deno's AES GCM authentication tags are not verified
CVE-2025-21620
DE
deno
denoland
7.5
1%
Jan 6Deno's authorization headers not dropped when redirecting cross-origin
CVE-2024-32468
DE
deno
denoland
5.4
0%
Nov 25Improper neutralization of input during web page generation ("Cross-site Scripting") in deno_doc HTML generator
CVE-2024-52793
ST
std
denoland
5.1
1%
Nov 22XSS vulnerability in serveDir API of @std/http/file-server on POSIX systems
CVE-2024-37150
DE
deno
denoland
6.5
0%
Jun 6Private npm registry support used scope auth token for downloading tarballs
CVE-2024-34346
DE
deno
denoland
9.0
0%
May 7Deno contains a permission escalation via open of privileged files with missing `--deny` flag
CVE-2024-32477
DE
deno
denoland
7.4
0%
Apr 18Race condition when flushing input stream leads to permission prompt bypass
CVE-2024-27936
DE
deno
denoland
6.5
1%
Mar 6Deno interactive permission prompt spoofing via improper ANSI stripping
CVE-2024-27935
DE
deno
denoland
8.3
1%
Mar 6Deno's Node.js Compatibility Runtime has Cross-Session Data Contamination
CVE-2024-27934
DE
deno
denoland
8.8
0%
Mar 6*const c_void / ExternalPointer unsoundness leading to use-after-free
CVE-2024-27933
DE
deno
denoland
8.8
2%
Mar 6Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass
CVE-2024-27932
DE
deno
denoland
4.6
1%
Mar 6Deno's improper suffix match testing for DENO_AUTH_TOKENS
CVE-2024-27931
DE
deno
denoland
6.5
0%
Mar 5Insufficient permission checking in `Deno.makeTemp*` APIs
CVE-2023-33966
DE
deno
denoland
9.8
1%
May 31Deno missing "--allow-net" permission check for built-in Node modules
CVE-2023-28446
DE
deno
denoland
8.8
1%
Mar 24Deno is vulnerable to interactive `run` permission prompt spoofing via improper ANSI neutralization
CVE-2023-28445
DE
deno
denoland
9.8
1%
Mar 23Deno improperly handles resizable ArrayBuffer
CVE-2023-22499
DE
deno
denoland
7.5
1%
Jan 17Interactive permission prompt spoofing in Deno