CycloneDX has 3 CVEs on record. 2 were published in the last 90 days. The median CVSS is 8.5 (high). The most common weakness class is CWE-78 (3).
CVEs per month
Last 12 months, by publish date
1025/101125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/09
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.5
- Publish → KEV
- —
- Last 90 days
- 2 prev 1
Products
- @cyclonedx/cdxgen 1
- @cyclonedx/cyclonedx-npm 1
- cyclonedx-node-npm 1
3
Total CVEs
0
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
CVE-2026-71538High· 8.5@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects47CVE-2026-55849High@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument41GHSA-5vwr-qchf-q4pfMedium@cyclonedx/cdxgen: Maven project scanning may allow shell command injection through repository-controlled module paths28
CycloneDX vulnerabilities
CVEs affecting CycloneDX, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-71538High· 8.5@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects
@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. Prior to version 6.0.0, the Windows fallback path in src/npmRunner.ts, used when npm_execpath does not provide the npm CLI path, can construct a she…
▾ TwilightCycloneDX · cyclonedx-node-npmEPSS 0.15%via NVD
GHSA-5vwr-qchf-q4pfMedium@cyclonedx/cdxgen: Maven project scanning may allow shell command injection through repository-controlled module paths
@cyclonedx/cdxgen: Maven project scanning may allow shell command injection through repository-controlled module paths
▾ Sunlitcyclonedx · @cyclonedx/cdxgenvia GHSA
CVE-2026-55849High@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument
@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument
▾ Twilightcyclonedx · @cyclonedx/cyclonedx-npmEPSS 0.24%via GHSA