Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

113 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

CVE-2026-102820

pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)

CVE-2026-102821

Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey

CVE-2026-102342

Ammonia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

microsandbox: Secret values exposed in world-readable process arguments

RMCP: Custom HTTP headers leak to cross-origin redirect targets

gix-sec safe.directory protections absent for elevated administrators

SWC HTML minifier may allow script element breakout when minifying embedded JSON

SurrealDB allows bypass of deny-net flags via DNS resolution

Hurl: Cookies in Cookies section leak when redirecting to a different host

gix-packetline: reachable panic on empty side-band packet (pre-auth network DoS)

mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)

SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users

Russh: Channel-scoped server callbacks can be reached without an open channel

mv: symlinks expanded during cross-device move (resource exhaustion / data duplication)

rm: 'rm -rf ./' (and ./// variants) silently deletes current directory contents, bypassing dot protection

rm: --preserve-root bypassed via a symlink to / (string check instead of dev/inode)

install -D: symlink race in directory creation allows arbitrary file overwrite

install: TOCTOU symlink race (unlink-then-create without O_EXCL) allows arbitrary file overwrite

zebrad has persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip

Zebra: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier Rejection

CVE-2026-104434

zebrad vulnerable to full node denial of service via crafted Sapling receiver in z_listunifiedreceivers

zebrad has full node denial of service via non-ASCII LongPollId in getblocktemplate

SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect

SurrealDB: Graph traversal bypasses table SELECT permissions

SurrealDB: Scraping a TABLE with no available PERMISSIONS to current auth level

Cargo crates in third party registries can override the cached source of other crates

WASI hard links and renames bypass wasmtime-wasi's FilePerms for destination

Mise's local credential_command executes untrusted config

Cloudflare Quiche: Use-after-free in connection ID iterator FFI functions

tract: Arbitrary file read via unsanitized ONNX external_data `location` (path traversal) on model load in tract-onnx

tract-nnef: integer overflow in NNEF `.dat` tensor parser yields an out-of-bounds read on model load

Deno: Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks

Russh: Unchecked keyboard-interactive prompt count in client auth path

rattler has an entry-point path traversal in noarch:python install (arbitrary file write)

unbounded-spsc: Sender::send pointer-as-value transmute causes OOB read and fake-Arc drop under TX/RX race

nono: Sandbox escape on Linux via D-Bus: `systemd-run --user`

nimiq-primitives: BlockInclusionProof interlink issue when hops are empty

Zebra Vulnerable to Allocation Amplification in Inbound Network Deserializers

Tauri has an Origin Confusion Issue that Allows Remote Pages to Invoke Local-Only IPC Commands

gix-transport: HTTP credentials leaked to redirected host in curl backend

Grid: Integer Overflow in Grid::expand_rows Leads to Safe-API Undefined Behavior

Lemmy has SSRF in /api/v3/post via Webmention dispatch

Lemmy has SSRF and internal image disclosure in post link metadata via unvalidated og:image

nimiq-transaction: UpdateValidator transactions allows voting key change without proof-of-knowledge

uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition

uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition

uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition

uutils coreutils doesn't properly handle setuid and setgid bits when ownership preservation fails

Zebra Vulnerable to Denial of Service via Interrupted JSON-RPC Requests from Authenticated Clients

Wasmtime has improperly masked return value from `table.grow` with Winch compiler backend

Scan your dependencies for these CVEs