Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

626 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

nimiq-blockchain is missing a wall-clock upper bound on block timestamps

Wasmtime has improperly masked return value from `table.grow` with Winch compiler backend

Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access

Wasmtime has out-of-bounds write or crash when transcoding component model strings

Wasmtime: Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift

Wasmtime has host panic when Winch compiler executes `table.fill`

Wasmtime has host data leakage with 64-bit tables and Winch

Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64

Wasmtime has a possible panic when lifting `flags` component value

Wasmtime: Panic when transcoding misaligned utf-16 strings

Wasmtime: Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding

Local settings bypass config trust checks

netavark has incorrect error handling for malformed tcp packets

libp2p-rendezvous: Unbounded rendezvous DISCOVER cookies enable remote memory exhaustion

libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers

Zebra has a Consensus Failure due to Improper Verification of V5 Transactions

libp2p-gossipsub: Remote crash via unchecked Instant overflow in heartbeat backoff expiry handling

GHSA-fxc9-7j2w-vx54

mpp has multiple payment bypass and griefing vulnerabilities

Zebra node crash — V5 transaction hash panic (P2P reachable)

Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()

CRL Distribution Point Scope Check Logic Error in AWS-LC

tar-rs `unpack_in` can chmod arbitrary directories by following symlinks

tar-rs incorrectly ignores PAX size headers if header size is nonzero

Salvo Affected by Denial of Service via Unbounded Memory Allocation in Form Data Parsing

Salvo has a Path Traversal in salvo-proxy::encode_url_path allows API Gateway Bypass

Gossipsub PRUNE.backoff Duration Overflow

lz4_flex's decompression can leak information from uninitialized memory or reused output buffer

Yamux vulnerable to remote Panic via malformed Data frame with SYN set and len = 262145

Deno vulnerable to command Injection via incomplete shell metacharacter blocklist in node:child_process

rs-soroban-sdk: `Fr` scalar field equality comparison bypasses modular reduction

Yamux vulnerable to remote Panic via malformed WindowUpdate credit

Poseidon V1 variable-length input collision via implicit zero-padding

ZeptoClaw: Path boundary checks bypass via symlink, TOCTOU, and hardlink

ZeptoClaw: Generic webhook channel trusts caller-supplied identity fields; allowlist is checked against untrusted payload data

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

RSSN has Arbitrary Code Execution via Unvalidated JIT Instruction Generation in C-FFI Interface

Pingora vulnerable to cache poisoning via insecure-by-default cache key

Pingora has HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing

Pingora vulnerable to HTTP Request Smuggling via Premature Upgrade

GHSA-5wp8-q9mx-8jx8

zeptoclaw has Shell allowlist-blocklist bypass via command/argument injection and file name wildcards

Lemmy has unauthenticated SSRF via file_type query parameter injection in image endpoint

Vaultwarden's Collection Management Operations Allowed Without `manage` Verification for Manager Role

Vaultwarden has Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager

Vaultwarden has 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement

AWS-LC has PKCS7_verify Signature Validation Bypass

AWS-LC has Timing Side-Channel in AES-CCM Tag Verification

AWS-LC has PKCS7_verify Certificate Chain Validation Bypass

theshit's Improper Privilege Dropping Allows Local Privilege Escalation via Command Re-execution

uv has ZIP payload obfuscation through parsing differentials

Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover

Scan your dependencies for these CVEs