Vulnerability library
Current and historical records. Severity, patch status and exploitation status are kept separate, and Node.js core issues are never conflated with npm package issues.
A record can be Critical, have a patch available, and still have unknown exploitation status. A patch release does not mean every host installed it. The table shows each dimension rather than one “danger/resolved” badge.
PHP
5 recordsPHP2Shell: RCE via OOM corruption
PHP2Shell: RCE via stale global state
PHP-CGI argument injection on Windows
PHP-FPM environment path underflow
PHP session upload progress RCE
Node.js
2 recordsNode.js Brotli decoder out-of-bounds write
Node.js Windows batch-file command injection
npm
2 recordslodash template command injection
event-stream npm supply-chain compromise
Java
1 recordsLog4Shell (Apache Log4j JNDI RCE)
OpenSSL
1 recordsHeartbleed (OpenSSL heartbeat over-read)
Bash
1 recordsShellshock (Bash environment function injection)
Node.js core vs npm
Node.js core vulnerabilities require a runtime update. npm package issues require dependency resolution. The library labels them separately.
Historical records
Log4Shell, Heartbleed and Shellshock are included for comparison. The relation label says “historical reference”; it does not claim a shared root cause.
How to read status
See the advisory reading guide for CVSS versions, KEV and the four exploitation evidence states.