Browse CVEs by Ecosystem and Severity

DeepSeek TUI has SSRF IPV6 bypass

DeepSeek TUI has SSRF via HTTP Redirect Bypass in fetch_url Tool

Anchor: Program<'info, System> is not properly validated

smallbitvec: Integer overflow in safe API leads to heap buffer overflow

Zebra has Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning

gix-fs: Symlink prefix-reuse allows worktree escape during checkout

scim_proto and kanidm_proto have an authenticated process abort via SCIM filter stack exhaustion

rmcp Streamable HTTP server transport has a DNS rebinding vulnerability

rust-openssl has undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs

RustFS: ListServiceAccount authorizes against wrong admin action, enabling cross-user enumeration and root service account takeover

gix and gitoxide: unvalidated submodule name traverses out of .git/modules and redirects state() / open() to another repository

gix and gitoxide's symlinked .gitmodules are followed and parsed from outside of the repository

gix-pack has multiple DoS vectors: unchecked indexing panics and uncapped OOM allocations from crafted pack data

gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update() Enables Arbitrary Command Execution via .gitmodules

gix's submodule name validation bypass + trust inheritance flaw enables path traversal and credential disclosure

awslabs/tough is Missing Delegated Metadata Validation

Hickory DNS's Record Cache Accepts AUTHORITY-Section NS from Sibling Zone via Parent-Pool Zone-Context Elevation

rustls-webpki: Denial of service via panic on malformed CRL BIT STRING

russh has pre-auth DoS via unbounded allocation in its keyboard-interactive auth handler

rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1

rust-openssl has incorrect bounds assertion in aes key wrap

rust-openssl: rustMdCtxRef::digest_final() writes past caller buffer with no length check

rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer

RustFS: Missing admin authorization on notification target endpoints allows unauthenticated configuration of event webhooks

nimiq-primitives: Node crash due to missing interlink validation in election macro block proposals

uutils coreutils has a Time-of-Check to Time-of-Use (TOCTOU) race condition

uutils coreutils has an Untrusted Search Path

Zebra: Cached Mempool Verification Bypasses Consensus Rules for Ahead-of-Tip Blocks

thin-vec: Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics

SP1 V6 Recursion Circuit Row-Count Binding Gap

Local settings bypass config trust checks

netavark has incorrect error handling for malformed tcp packets

libp2p-rendezvous: Unbounded rendezvous DISCOVER cookies enable remote memory exhaustion

libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers

Zebra has a Consensus Failure due to Improper Verification of V5 Transactions

libp2p-gossipsub: Remote crash via unchecked Instant overflow in heartbeat backoff expiry handling

CRL Distribution Point Scope Check Logic Error in AWS-LC

Salvo Affected by Denial of Service via Unbounded Memory Allocation in Form Data Parsing

Salvo has a Path Traversal in salvo-proxy::encode_url_path allows API Gateway Bypass

Gossipsub PRUNE.backoff Duration Overflow

lz4_flex's decompression can leak information from uninitialized memory or reused output buffer

Yamux vulnerable to remote Panic via malformed Data frame with SYN set and len = 262145

Deno vulnerable to command Injection via incomplete shell metacharacter blocklist in node:child_process

Yamux vulnerable to remote Panic via malformed WindowUpdate credit

Poseidon V1 variable-length input collision via implicit zero-padding

ZeptoClaw: Path boundary checks bypass via symlink, TOCTOU, and hardlink

ZeptoClaw: Generic webhook channel trusts caller-supplied identity fields; allowlist is checked against untrusted payload data

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

Pingora vulnerable to cache poisoning via insecure-by-default cache key

Lemmy has unauthenticated SSRF via file_type query parameter injection in image endpoint