Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

626 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

install: TOCTOU symlink race (unlink-then-create without O_EXCL) allows arbitrary file overwrite

chmod: --preserve-root bypassed by any path that resolves to root (e.g. /../)

jxl-grid on 32-bit platforms has an out-of-bounds writes due to integer overflow

Zebra Address Book Aborted by IPv4-Mapped Mempool Misbehavior Update

zebrad has persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip

Zebra: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier Rejection

zebrad has consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser

Zebra has block suppression via NU5 same-header body poisoning of sent-hash cache

CVE-2026-104434

zebrad vulnerable to full node denial of service via crafted Sapling receiver in z_listunifiedreceivers

zebrad has full node denial of service via non-ASCII LongPollId in getblocktemplate

SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect

SurrealDB: Graph traversal bypasses table SELECT permissions

SurrealDB: Scraping a TABLE with no available PERMISSIONS to current auth level

SurrealDB has Denial of Service in JSON parser due to nested objects

GHSA-4vgr-h27g-cf9p

SurrealDB: HTTP RPC Session Race Condition Allows Privilege Escalation

GHSA-5qfp-32cf-69jh

SurrealDB: HTTP /rpc `sessions` method leaks attached session UUIDs, enabling full session hijack by anonymous callers

Cargo crates in third party registries can override the cached source of other crates

WASI hard links and renames bypass wasmtime-wasi's FilePerms for destination

Mise's local credential_command executes untrusted config

Mise vulnerable to arbitrary command execution via task-include files in an untrusted, config-less repository

Mise Vulnerable to Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass)

Cloudflare Quiche: Use-after-free in connection ID iterator FFI functions

tract: Arbitrary file read via unsanitized ONNX external_data `location` (path traversal) on model load in tract-onnx

tract-nnef: integer overflow in NNEF `.dat` tensor parser yields an out-of-bounds read on model load

Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)

Deno: Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks

Deno: Miller-Rabin Primality Test Allows Zero Rounds

Deno: Command Injection via spawnSync & spawn on Windows

Russh SSH message fields were decoded through allocation-first parsers before field-specific bounds

Russh: Unchecked keyboard-interactive prompt count in client auth path

Routinator has cache path traversal when processing the module component of rsync URIs

Routinator crashes when encountering maliciously crafted RRDP XML files

Routinator crashes when sending a maliciously crafted select-asn query parameter

wasmtime-wasi: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction

Rojo development server vulnerable to DNS rebinding, allowing unauthenticated read/write access and local program execution

rattler has an entry-point path traversal in noarch:python install (arbitrary file write)

russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets

unbounded-spsc: Sender::send pointer-as-value transmute causes OOB read and fake-Arc drop under TX/RX race

nono: Sandbox escape on Linux via D-Bus: `systemd-run --user`

Deno's TLS retry copies stale upgrade hook, risking plaintext traffic

Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host

BoxLite: Permission Bypass Allows Modification of Read-Only Files

Russh: Unchecked CryptoVec allocation and growth handling is reachable

Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss

nimiq-primitives: Panic DoS in trie chunk processing via ROOT-keyed item

nimiq-primitives: BlockInclusionProof interlink issue when hops are empty

nimiq-keys: Unchecked Ed25519 signature length in TaggedPublicKey::verify causes remote node panic via DHT

DeepSeek TUI: task_create Insecure Defaults Enable RCE via Prompt Injection in Project Files

DeepSeek TUI has SSRF IPV6 bypass

DeepSeek TUI: run_tests Tool Enables RCE via Malicious Repository Without Approval

Scan your dependencies for these CVEs