Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

340 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

SurrealDB memory exhaustion via string::replace using regex

SurrealDB has uncaught exception in Net module that leads to database crash

Apollo Compiler Named Fragment Processing Vulnerability

Apollo Router Query Validation Vulnerable to Excessive Resource Consumption via Named Fragment Processing

Apollo Router Operation Limits Vulnerable to Bypass via Integer Overflow

Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion

Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass

Redlib allows a Denial of Service via DEFLATE Decompression Bomb in restore_preferences Form

zip Incorrectly Canonicalizes Paths during Archive Extraction Leading to Arbitrary File Write

Below has Incorrect Permission Assignment for Critical Resource

Soundness issue with Plonky2 look up tables

Vaultwarden vulnerable to user impersonation

fetch: Authorization headers not dropped when redirecting cross-origin

rPGP Potential Resource Exhaustion when handling Untrusted Messages

rPGP Panics on Malformed Untrusted Input

GHSA-wwq9-3cpr-mm53

Borsh serialization of HashMap is non-canonical

SurrealDB: Improper Authorization in Select Permissions

SurrealDB has an Uncaught Exception Handling Parsing Errors on Empty Strings

async-graphql Directive Overload

Heap-based Buffer Overflow in sqlite-vec

Untrusted Query Object Evaluation in RPC API

ic-cdk has a memory leak when calling a canister method via `ic_cdk::call`

Missing connection timeout in Aardvark-dns

Denial of service in quinn-proto when using `Endpoint::retry()`

Apollo Router Coprocessors may cause Denial-of-Service when handling request bodies

Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queries

Russh has an OOM Denial of Service due to allocation of untrusted amount

Boa has an uncaught exception when transitioning the state of `AsyncGenerator` objects

Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands

gix-path can use a fake program files location

Unlimited number of NTS-KE connections can crash ntpd-rs server

Rhai stack overflow vulenrability

gix traversal outside working tree enables arbitrary code execution

Tor Arti's STUB circuits incorrectly have a length of 2

Deno permission escalation vulnerability via open of privileged files with missing `--deny` flag

Yamux Memory Exhaustion Vulnerability via Active::pending_frames property

Denial of Service Vulnerability in Rustls Library

cassandra-rs's non-idiomatic use of iterators leads to use after free

tls-listener affected by the slow loris vulnerability with default configuration

Wasmi Out-of-bounds Write for host to Wasm calls with more than 128 Parameters

Apollo Router's Compressed Payloads do not respect HTTP Payload Limits

*const c_void / ExternalPointer unsoundness leading to use-after-free

Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass

Deno's deno_runtime vulnerable to interactive permission prompt spoofing via improper ANSI stripping

Deno's Node.js Compatibility Runtime has Cross-Session Data Contamination

Mio's tokens for named pipes may be delivered after deregistration

Externally Controlled Format String in Scripting Functions

serde-json-wasm stack overflow during recursive JSON parsing

eza Potential Heap Overflow Vulnerability for AArch64

Any authenticated user may obtain private message details from other users on the same instance

Scan your dependencies for these CVEs