Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

626 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

GHSA-wwq9-3cpr-mm53

Borsh serialization of HashMap is non-canonical

rustls network-reachable panic in `Acceptor::accept`

SurrealDB has an Uncaught Exception Sorting Tables by Random Order

SurrealDB has an Uncaught Exception in Function Generating Random Time

wasm3 uncontrolled memory allocation vulnerability

jj vulnerable to path traversal via crafted Git repositories

cap-std doesn't fully sandbox all the Windows device filenames

Wasmtime doesn't fully sandbox all the Windows device filenames

wasmtime has a runtime crash when combining tail calls with trapping imports

SurrealDB: Improper Authorization in Select Permissions

SurrealDB has an Uncaught Exception Handling Parsing Errors on Empty Strings

async-graphql Directive Overload

Heap-based Buffer Overflow in sqlite-vec

Untrusted Query Object Evaluation in RPC API

ic-cdk has a memory leak when calling a canister method via `ic_cdk::call`

Missing connection timeout in Aardvark-dns

Denial of service in quinn-proto when using `Endpoint::retry()`

DOM clobbering could escalate to Cross-site Scripting (XSS)

Apollo Router Coprocessors may cause Denial-of-Service when handling request bodies

Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queries

Miniscript allows stack consumption

Russh has an OOM Denial of Service due to allocation of untrusted amount

Boa has an uncaught exception when transitioning the state of `AsyncGenerator` objects

Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands

gix-path can use a fake program files location

SurrealDB vulnerable to Improper Authentication when Changing Databases as Scope User

panic on parsing crafted phonenumber inputs

MongoDB Rust driver may issue unintended commands

Unlimited number of NTS-KE connections can crash ntpd-rs server

Rhai stack overflow vulenrability

Unable to generate the correct character set

qdrant is vulnerable to path traversal due to improper input validation in the `/collections/{name}/snapshots/upload` endpoint

gix refs and paths with reserved Windows device names access the devices

gix traversal outside working tree enables arbitrary code execution

Tor Arti's STUB circuits incorrectly have a length of 2

Spin applications with specific configuration vulnerable to potential network sandbox escape

Deno permission escalation vulnerability via open of privileged files with missing `--deny` flag

Apollo Router vulnerable to Critical Regression In Query Plan Cache

Yamux Memory Exhaustion Vulnerability via Active::pending_frames property

Denial of Service Vulnerability in Rustls Library

gix-transport indirect code execution via malicious username

cassandra-rs's non-idiomatic use of iterators leads to use after free

tls-listener affected by the slow loris vulnerability with default configuration

Wasmi Out-of-bounds Write for host to Wasm calls with more than 128 Parameters

Apollo Router's Compressed Payloads do not respect HTTP Payload Limits

*const c_void / ExternalPointer unsoundness leading to use-after-free

Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass

Deno's deno_runtime vulnerable to interactive permission prompt spoofing via improper ANSI stripping

Deno's Node.js Compatibility Runtime has Cross-Session Data Contamination

Mio's tokens for named pipes may be delivered after deregistration

Scan your dependencies for these CVEs