vercel
Security Risk Profile
41
/100
mediumSecurity Risk Score
Comprehensive risk assessment based on 94 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from January 23, 2017 to present
94
Total CVEs
35
Critical+High
7
Exploited
9
Unpatched
Threat Assessment
Avg CVSS
6.4
Base severity
Avg EPSS
8%
Exploit probability
Unpatched
9
Critical/High
Risk Level
41/100
medium
⚠️ 7 Active Exploits⚡ 5 Zero-Days
Severity Distribution
Critical
3High
32Medium
24Low
8Exploit Likelihood
>50% chance
120-50%
05-20%
0<5%
11Age Distribution
Common Weaknesses (CWE)
1
SSRF
5
2
XSS
4
3
Input Validation
4
4
Infoleak
3
5
Command Injection
2
Most Affected Products
1. Vercel Next.js Node.js497
2. npm/next78
3. Vercel Next.js33
4. npm/react-server-dom-webpack14
5. npm/react-server-dom-turbopack14
Recent Vulnerabilities
See more →CVE-2026-8769
CVSS 2.1EPSS 1%low
vercel ai provider-utils response-handler.ts createJsonErrorResponseHandler resource consumption
5/17/2026🔧 No Patch
CVE-2026-8768
CVSS 5.5EPSS 0%medium
vercel ai provider-utils download-blob.ts validateDownloadUrl server-side request forgery
5/17/2026🔧 No Patch
CVE-2026-8767
CVSS 1.3EPSS 4%low
vercel ai PR Branch Name Interpolation prettier-on-automerge.yml run os command injection
5/17/2026🔧 No Patch
CVE-2026-45773
CVSS 5.1medium
Turborepo: Login callback CSRF/session fixation
5/15/2026
CVE-2026-46508
CVSS 8.4high
Turborepo: VSCode Extension command injection
5/15/2026🔧 No Patch
CVE-2026-45772
CVSS 0.0low
Turborepo: Unexpected local code execution during Yarn Berry detection
5/15/2026
REDHAT-BUG-2477207
CVSS 7.0high
5/13/2026🔧 No Patch
REDHAT-BUG-2477193
CVSS 7.0high
5/13/2026🔧 No Patch
REDHAT-BUG-2477187
CVSS 7.0high
5/13/2026🔧 No Patch
REDHAT-BUG-2477188
CVSS 7.0high
5/13/2026🔧 No Patch
Monitor vercel in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.