Exposição de Express

Web frameworks, Web servers

score de exposição

78.970

sites usam

em exploração

críticos

Análise Vexday

O framework Express apresenta uma taxa de exploração ativa expressivamente acima da média do catálogo CISA KEV, com 9,09% de suas CVEs confirmadas em exploração — 20,2 vezes o índice geral de 0,45% —, o que indica risco operacional desproporcional ao volume total de vulnerabilidades catalogadas. O tipo de falha predominante é CWE-79 (Cross-Site Scripting), sugerindo padrões recorrentes de sanitização inadequada de entrada. A CVE mais crítica atualmente ativa, CVE-2026-34909, registra EPSS de 0,0227, sinalizando probabilidade ainda moderada de exploração em larga escala, porém já confirmada no KEV. O volume elevado de 7 vulnerabilidades surgidas nos últimos 90 dias reforça a necessidade de ciclos de atualização e revisão de dependências mais frequentes para ambientes que utilizam Express em produção.

CVEs

13 resultados

CVE-2026-34909CRITICALA malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the uEPSS 65.0%KEV CVE-2026-47370CRITICALA malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain deEPSS 0.8%CVE-2024-29041MEDIUMExpress.js Open Redirect in malformed URLsEPSS 0.8%CVE-2026-77550CRITICALA malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devicEPSS 0.5%CVE-2024-43796MEDIUMexpress vulnerable to XSS via response.redirect()EPSS 0.5%CVE-2024-9266MEDIUMOpen RedirectEPSS 0.5%CVE-2024-10491MEDIUMPreload arbitrary resources by injecting additional `Link` headersEPSS 0.4%CVE-2026-47368HIGHA malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to obtaiEPSS 0.4%CVE-2026-47369CRITICALA malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain deEPSS 0.3%CVE-2026-77549CRITICALA malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of CRLF Sequences vulneraEPSS 0.3%CVE-2026-42349HIGHClerk: Authorization bypass when combining organization, billing, or reverification checksEPSS 0.2%CVE-2026-27508MEDIUMSmoothwall Express < 3.1 Update 13 Reflected XSS in redirect.cgi via url ParameterEPSS 0.2%CVE-2026-26352MEDIUMSmoothwall Express < 3.1 Update 13 Stored XSS in vpnmain.cgi via VPN_IP ParameterEPSS 0.1%