Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

340 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

Vaultwarden's Collection Management Operations Allowed Without `manage` Verification for Manager Role

Vaultwarden has Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager

AWS-LC has PKCS7_verify Signature Validation Bypass

AWS-LC has Timing Side-Channel in AES-CCM Tag Verification

AWS-LC has PKCS7_verify Certificate Chain Validation Bypass

theshit's Improper Privilege Dropping Allows Local Privilege Escalation via Command Re-execution

RustFS: Missing Post Policy Validation leads to Arbitrary Object Write

Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process

Improper Digest Verification in httpsig-hyper May Allow Message Integrity Bypass

The rs-soroban-sdk #[contractimpl] macro calls inherent function instead of trait function when names collide

Panic in `libcrux-psq` on decryption of malformed AES-GCM ciphertext

qdrant has arbitrary file write via `/logger` endpoint

RustFS has SourceIp bypass via spoofed X-Forwarded-For/Real-IP headers

Clatter has a PSK Validity Rule Violation issue

soroban-fixed-point-math has Incorrect Rounding and Overflow Handling in Signed Fixed-Point Math with Negatives

SurrealDB Affected by Confused Deputy Privilege Escalation through Future Fields and Functions

Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass

RustCrypto Utilities cmov: `thumbv6m-none-eabi` compiler emits non-constant time assembly when using `cmovnz`

RustCrypto Has Insufficient Length Validation in decrypt() in SM2-PKE

SM2-PKE has Unchecked AffinePoint Decoding (unwrap) in decrypt()

SM2-PKE has 32-bit Biased Nonce Vulnerability

Salvo is vulnerable to reflected XSS in the list_html function

Salvo is vulnerable to stored XSS in the list_html function by uploading files with malicious names

RustFS Path Traversal Vulnerability

theshit vulnerable to unsafe loading of user-owned Python rules when running as root

Critical Use-After-Free in Wasmi's Linear Memory

GHSA-2cgv-28vr-rv6j

libcrux incorrectly calculates on aarch64

cggmp24 and cggmp21 are vulnerable to signature forgery through altered presignatures

thread-amount Vulnerable to Resource Exhaustion (Memory and Handle Leaks) on Windows and macOS

Apollo Router Affected by an Access Control Bypass on Polymorphic Types

Apollo Router Improperly Enforces Renamed Access Control Directives

youki container escape and denial of service due to arbitrary write gadgets and procfs write redirects

youki container escape via "masked path" abuse due to mount race conditions

GHSA-wwxp-hxh6-8gf8

binary_vec_io access memory out-of-bounds in binary_read_to_ref and binary_write_from_ref

astral-tokio-tar Vulnerable to PAX Header Desynchronization

alloy-dyn-abi has DoS vulnerability on `alloy_dyn_abi::TypedData` hashing

MongoDB Rust Driver has certificate validation disabled when `tlsInsecure=False` appears in connection string

cel-rust May Panic During Parsing of Invalid CEL Expressions

Deno is Vulnerable to Command Injection on Windows During Batch File Execution

GHSA-pfp7-vxgr-83pw

toodee is vulnerable to Heap Buffer Overflow through its DrainCol Destructor

GHSA-3632-54q8-m96x

arenavec has multiple memory corruption vulnerabilities in safe APIs

Youki: If /proc and /sys in the rootfs are symbolic links, they can potentially be exploited to gain access to the host root filesystem.

quiche connection ID retirement can trigger an infinite loop

vproxy Divide by Zero DoS Vulnerability

GHSA-7mcq-f592-pf7v

Slice Ring Buffer and Slice Deque contains four unique double-free vulnerabilities triggered through safe APIs

Pingora has a Request Smuggling Vulnerability

users may append `root` to group listings

Deno's AES GCM authentication tags are not verified

OpenVM allows the byte decomposition of pc in AUIPC chip to overflow

SurrealDB CPU exhaustion via custom functions result in total DoS

Scan your dependencies for these CVEs