Most-vulnerable packages of all time
Packages with the largest number of distinct CVEs across all ingested ecosystems.
Last updated 6/15/2026, 3:55:33 PM
| # | Ecosystem | Package | CVEs | KEV | Max EPSS |
|---|---|---|---|---|---|
| 1 | Debian | chromium | 3078 | 63 | 93.3% |
| 2 | Debian | webkit2gtk | 678 | 38 | 89.9% |
| 3 | Debian | wpewebkit | 315 | 36 | 82.8% |
| 4 | Debian | linux | 14308 | 30 | 94.3% |
| 5 | Debian | firefox-esr | 953 | 11 | 93.3% |
| 6 | Debian | roundcube | 87 | 11 | 93.3% |
| 7 | Debian | thunderbird | 901 | 10 | 93.3% |
| 8 | Debian | linux-6.1 | 2962 | 6 | 43.5% |
| 9 | Bitnami | roundcube | 17 | 6 | 93.3% |
| 10 | Debian | apache2 | 248 | 5 | 94.4% |
| 11 | Alpine | apache2 | 115 | 5 | 94.4% |
| 12 | Packagist | drupal/core | 107 | 5 | 94.5% |
| 13 | Maven | org.apache.tomcat.embed:tomcat-embed-core | 72 | 5 | 94.5% |
| 14 | Debian | exim4 | 68 | 5 | 93.9% |
| 15 | Maven | org.apache.struts:struts2-core | 60 | 5 | 94.4% |
| 16 | NuGet | CefSharp.WinForms | 5 | 5 | 93.0% |
| 17 | NuGet | CefSharp.Wpf | 5 | 5 | 93.0% |
| 18 | NuGet | CefSharp.Common | 5 | 5 | 93.0% |
| 19 | NuGet | CefSharp.Wpf.HwndHost | 5 | 5 | 93.0% |
| 20 | Bitnami | gitlab | 1068 | 4 | 94.5% |
| 21 | Maven | org.jenkins-ci.main:jenkins-core | 251 | 4 | 94.5% |
| 22 | Packagist | craftcms/cms | 97 | 4 | 93.9% |
| 23 | Bitnami | apache | 95 | 4 | 94.4% |
| 24 | Packagist | drupal/drupal | 68 | 4 | 94.5% |
| 25 | Bitnami | drupal | 64 | 4 | 76.9% |
| 26 | Debian | imagemagick | 722 | 3 | 93.6% |
| 27 | Packagist | magento/community-edition | 353 | 3 | 94.2% |
| 28 | NuGet | Microsoft.ChakraCore | 247 | 3 | 91.0% |
| 29 | Debian | graphicsmagick | 142 | 3 | 93.6% |
| 30 | Bitnami | tomcat | 79 | 3 | 94.5% |
| 31 | Debian | tomcat9 | 78 | 3 | 94.5% |
| 32 | PyPI | salt | 69 | 3 | 94.4% |
| 33 | npm | electron | 48 | 3 | 93.3% |
| 34 | Maven | org.apache.tomcat:tomcat-catalina | 40 | 3 | 94.4% |
| 35 | NuGet | DotNetNuke.Core | 35 | 3 | 94.3% |
| 36 | Debian | activemq | 34 | 3 | 94.4% |
| 37 | Debian | drupal7 | 33 | 3 | 94.5% |
| 38 | PyPI | langflow | 23 | 3 | 92.7% |
| 39 | Debian | bash | 16 | 3 | 94.2% |
| 40 | Bitnami | java | 208 | 2 | 34.3% |
| 41 | Bitnami | java-min | 208 | 2 | 34.3% |
| 42 | Bitnami | jre | 208 | 2 | 34.3% |
| 43 | Debian | samba | 198 | 2 | 94.4% |
| 44 | Bitnami | golang | 171 | 2 | 94.4% |
| 45 | PyPI | apache-airflow | 132 | 2 | 94.3% |
| 46 | Bitnami | airflow | 126 | 2 | 94.3% |
| 47 | Debian | rails | 113 | 2 | 94.3% |
| 48 | Alpine | nodejs | 109 | 2 | 94.4% |
| 49 | Bitnami | jenkins | 109 | 2 | 94.5% |
| 50 | Bitnami | grafana | 97 | 2 | 94.4% |
| 51 | Bitnami | magento | 96 | 2 | 94.2% |
| 52 | Debian | freetype | 94 | 2 | 93.0% |
| 53 | Alpine | samba | 92 | 2 | 94.4% |
| 54 | Bitnami | dotnet-sdk | 86 | 2 | 94.4% |
| 55 | Bitnami | dotnet | 86 | 2 | 94.4% |
| 56 | RubyGems | actionpack | 62 | 2 | 91.9% |
| 57 | Debian | chromium-browser | 61 | 2 | 66.9% |
| 58 | Go | github.com/grafana/grafana | 59 | 2 | 94.4% |
| 59 | Debian | tomcat10 | 52 | 2 | 94.4% |
| 60 | Debian | sudo | 47 | 2 | 92.6% |
| 61 | Maven | org.elasticsearch:elasticsearch | 43 | 2 | 92.3% |
| 62 | Bitnami | activemq | 35 | 2 | 94.4% |
| 63 | Maven | org.apache.solr:solr-core | 30 | 2 | 94.5% |
| 64 | Bitnami | minio | 26 | 2 | 94.0% |
| 65 | PyPI | litellm | 20 | 2 | 88.6% |
| 66 | Bitnami | aspnet-core | 20 | 2 | 94.4% |
| 67 | Maven | org.apache.activemq:activemq-client | 18 | 2 | 94.4% |
| 68 | Debian | open-vm-tools | 17 | 2 | 2.2% |
| 69 | Debian | lucene-solr | 17 | 2 | 94.5% |
| 70 | Debian | policykit-1 | 16 | 2 | 88.1% |
| 71 | RubyGems | actionview | 13 | 2 | 94.3% |
| 72 | Bitnami | apisix | 13 | 2 | 94.4% |
| 73 | Maven | org.geoserver.web:gs-web-app | 13 | 2 | 94.4% |
| 74 | Maven | org.apache.logging.log4j:log4j-core | 11 | 2 | 94.4% |
| 75 | Debian | apache-log4j2 | 10 | 2 | 94.4% |
| 76 | Alpine | freetype | 9 | 2 | 93.0% |
| 77 | Maven | org.geoserver:gs-wms | 8 | 2 | 94.4% |
| 78 | Debian | php-pear | 6 | 2 | 93.4% |
| 79 | Debian | salt | 6 | 2 | 94.4% |
| 80 | Maven | org.ops4j.pax.logging:pax-logging-log4j2 | 4 | 2 | 94.4% |
| 81 | Alpine | mozjs60 | 2 | 2 | 84.3% |
| 82 | Debian | openssl | 269 | 1 | 94.5% |
| 83 | Debian | phpmyadmin | 256 | 1 | 93.3% |
| 84 | Debian | ghostscript | 162 | 1 | 92.9% |
| 85 | Packagist | magento/project-community-edition | 161 | 1 | 72.2% |
| 86 | Debian | glibc | 158 | 1 | 93.9% |
| 87 | Go | stdlib | 157 | 1 | 94.1% |
| 88 | Debian | cacti | 156 | 1 | 94.5% |
| 89 | Bitnami | joomla | 122 | 1 | 94.5% |
| 90 | Debian | zabbix | 117 | 1 | 93.7% |
| 91 | Bitnami | node-min | 112 | 1 | 94.4% |
| 92 | Bitnami | node | 112 | 1 | 94.4% |
| 93 | Debian | otrs2 | 103 | 1 | 34.7% |
| 94 | Bitnami | envoy | 87 | 1 | 94.4% |
| 95 | Alpine | ghostscript | 79 | 1 | 92.9% |
| 96 | Debian | php5 | 79 | 1 | 94.1% |
| 97 | Bitnami | php | 74 | 1 | 94.4% |
| 98 | Bitnami | php-min | 74 | 1 | 94.4% |
| 99 | Bitnami | libphp | 74 | 1 | 94.4% |
| 100 | Debian | trafficserver | 73 | 1 | 94.4% |