Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

626 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

risc0 vulnerable to arbitrary code execution in guest via memory safety failure in `sys_read`

astral-tokio-tar has a path traversal in tar extraction

httpsig-rs: HMAC verification is vulnerable to timing attack

SurrealDB is Vulnerable to Unauthorized Data Exposure via LIVE Query Subscriptions

GHSA-pfp7-vxgr-83pw

toodee is vulnerable to Heap Buffer Overflow through its DrainCol Destructor

frost-core: refresh shares with smaller min_signers will reduce security of group

GHSA-3632-54q8-m96x

arenavec has multiple memory corruption vulnerabilities in safe APIs

Youki: If /proc and /sys in the rootfs are symbolic links, they can potentially be exploited to gain access to the host root filesystem.

quiche connection ID retirement can trigger an infinite loop

RISC Zero Underconstrained Vulnerability: Division

russh is missing overflow checks during channel windows adjust

vproxy Divide by Zero DoS Vulnerability

GHSA-7mcq-f592-pf7v

Slice Ring Buffer and Slice Deque contains four unique double-free vulnerabilities triggered through safe APIs

Matrix Rust SDK vulnerable to SQL Injection through its EventCache implementation

letmein connection limiter allows an arbitrary amount of simultaneous connections

Pingora has a Request Smuggling Vulnerability

users may append `root` to group listings

Deno has --allow-read / --allow-write permission bypass in `node:sqlite`

Deno's AES GCM authentication tags are not verified

OpenVM allows the byte decomposition of pc in AUIPC chip to overflow

Pleezer resource exhaustion through uncollected hook script processes

SurrealDB bypass of deny-net flags via redirect results in server-side request forgery (SSRF)

SurrealDB CPU exhaustion via custom functions result in total DoS

SurrealDB memory exhaustion via string::replace using regex

SurrealDB server-takeover via SurrealQL injection on backup import

SurrealDB vulnerable to memory exhaustion via nested functions and scripts

SurrealDB has uncaught exception in Net module that leads to database crash

Apollo Compiler Named Fragment Processing Vulnerability

Apollo Router Query Validation Vulnerable to Excessive Resource Consumption via Named Fragment Processing

Apollo Router Operation Limits Vulnerable to Bypass via Integer Overflow

Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion

Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass

gitoxide does not detect SHA-1 collision attacks

Improper Scope Validation in the `open` Endpoint of `tauri-plugin-shell`

GHSA-vgmh-mqm4-8j88

pared Vulnerable to Use After Free in `Parc` and `Prc` Due to Missing Lifetime Constraints

Redlib allows a Denial of Service via DEFLATE Decompression Bomb in restore_preferences Form

CosmWasm Allows Bypass of Capability Restrictions in Blockchains

zip Incorrectly Canonicalizes Paths during Archive Extraction Leading to Arbitrary File Write

Below has Incorrect Permission Assignment for Critical Resource

Crash due to uncontrolled recursion in protobuf crate

Some AES functions may panic when overflow checking is enabled in ring

GHSA-f8qm-hmm3-fv7f

Namada-apps allows Excessive Computation in Mempool Validation

GHSA-82vg-5v4f-f9wq

Namada-apps can Crash with Excessive Computation in Mempool Validation

Hickory DNS's DNSSEC validation may accept broken authentication chains

Soundness issue with Plonky2 look up tables

ismp-grandpa crate accepted incorrect signatures

Vaultwarden vulnerable to user impersonation

fetch: Authorization headers not dropped when redirecting cross-origin

rPGP Potential Resource Exhaustion when handling Untrusted Messages

rPGP Panics on Malformed Untrusted Input

Scan your dependencies for these CVEs