CVE Browser

Search and filter CVEs by severity, ecosystem, EPSS score, and more.

Today 11 Last 7 days 2,779 Total CVEs 401,141 CISA KEV 1,731 Critical 42,394 All stats

Page 1

CVE-2026-90651 HIGH

Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the api_ssl_verif…

CVSS 8.1 EPSS 0.21% Sep 12, 2026

CVE-2026-59725 HIGH

Socket.IO: Engine.IO Polling Transport Connection Exhaustion

CVSS 7.5 EPSS 0.64% Jul 8, 2026

npm

CVE-2026-59724 HIGH

Socket.IO: Engine.IO WebTransport SID DoS

CVSS 7.5 EPSS 0.61% Jul 8, 2026

npm

CVE-2026-33151 HIGH

socket.io allows an unbounded number of binary attachments

CVSS 8.7 EPSS 0.63% Mar 20, 2026

npm

CVE-2024-38355 MEDIUM

Unhandled 'error' event in socket.io

CVSS 6.9 EPSS 0.81% Jun 19, 2024

npm

CVE-2023-32695 MEDIUM

Insufficient validation when decoding a Socket.IO packet

CVSS 6.9 EPSS 1.06% May 27, 2023

npm

CVE-2023-31125 MEDIUM

Uncaught exception in engine.io

CVSS 6.5 EPSS 1.33% May 8, 2023

npm

CVE-2022-41940 HIGH

Uncaught exception in engine.io

CVSS 7.1 EPSS 2.07% Nov 22, 2022

npm

CVE-2022-2421 CRITICAL

Socket.io - Improper type validation in attachment parsing

CVSS 10.0 EPSS 1.27% Oct 25, 2022

npm

CVE-2022-25867 HIGH

NULL Pointer Dereference

CVSS 7.5 EPSS 1.60% Aug 2, 2022

CVE-2022-21676 HIGH

Uncaught Exception in engine.io

CVSS 7.5 EPSS 2.76% Jan 12, 2022

npm

CVE-2020-28481 MEDIUM

Insecure Defaults

CVSS 5.3 EPSS 0.73% Jan 19, 2021

npm

CVE-2020-36048 HIGH

yarnpkg-socket.io/engine.io: allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport

CVSS 7.5 EPSS 3.24% Jan 7, 2021

npm

CVE-2020-36049 HIGH

yarnpkg-socket.io-parser: a denial of service (memory consumption) via a large packet because a concatenation approach is used

CVSS 7.5 EPSS 2.64% Jan 7, 2021

npm

CVE-2017-16031 HIGH

Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.9.6 and earlier depends on `Math.random()` to cre…

CVSS 7.5 EPSS 2.00% Jun 4, 2018

npm

CVE-2016-10536 MEDIUM

engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-directional communication layer for Socket.…

CVSS 5.9 EPSS 1.01% May 31, 2018

npm

CVE ID	Description	Severity	CVSS	EPSS	Ecosystems	Published
CVE-2026-90651	Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the api_ssl_verif…	HIGH	8.1	0.21%		Sep 12, 2026
CVE-2026-59725	Socket.IO: Engine.IO Polling Transport Connection Exhaustion	HIGH	7.5	0.64%	npm	Jul 8, 2026
CVE-2026-59724	Socket.IO: Engine.IO WebTransport SID DoS	HIGH	7.5	0.61%	npm	Jul 8, 2026
CVE-2026-33151	socket.io allows an unbounded number of binary attachments	HIGH	8.7	0.63%	npm	Mar 20, 2026
CVE-2024-38355	Unhandled 'error' event in socket.io	MEDIUM	6.9	0.81%	npm	Jun 19, 2024
CVE-2023-32695	Insufficient validation when decoding a Socket.IO packet	MEDIUM	6.9	1.06%	npm	May 27, 2023
CVE-2023-31125	Uncaught exception in engine.io	MEDIUM	6.5	1.33%	npm	May 8, 2023
CVE-2022-41940	Uncaught exception in engine.io	HIGH	7.1	2.07%	npm	Nov 22, 2022
CVE-2022-2421	Socket.io - Improper type validation in attachment parsing	CRITICAL	10.0	1.27%	npm	Oct 25, 2022
CVE-2022-25867	NULL Pointer Dereference	HIGH	7.5	1.60%		Aug 2, 2022
CVE-2022-21676	Uncaught Exception in engine.io	HIGH	7.5	2.76%	npm	Jan 12, 2022
CVE-2020-28481	Insecure Defaults	MEDIUM	5.3	0.73%	npm	Jan 19, 2021
CVE-2020-36048	yarnpkg-socket.io/engine.io: allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport	HIGH	7.5	3.24%	npm	Jan 7, 2021
CVE-2020-36049	yarnpkg-socket.io-parser: a denial of service (memory consumption) via a large packet because a concatenation approach is used	HIGH	7.5	2.64%	npm	Jan 7, 2021
CVE-2017-16031	Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.9.6 and earlier depends on `Math.random()` to cre…	HIGH	7.5	2.00%	npm	Jun 4, 2018
CVE-2016-10536	engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-directional communication layer for Socket.…	MEDIUM	5.9	1.01%	npm	May 31, 2018

Rows per page

Showing 1 to 16 CVEs · page 1