Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

758 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion

Memos has Cross-Site Scripting (XSS) Vulnerability in Image URLs

eKuiper API endpoints handling SQL queries with user-controlled table names.

Authentik has insufficient check for account active status when authenticating with OAuth/SAML Sources

NVIDIA Container Toolkit for all platforms contains a vulnerability in the update-ldcache hook

NVIDIA Container Toolkit for all platforms contains an Untrusted Search Path

Chall-Manager is vulnerable to Path Traversal when extracting/decoding a zip archive

Juju allows arbitrary executable uploads via authenticated endpoint without authorization

Juju zip slip vulnerability via authenticated endpoint

Helm vulnerable to Code Injection through malicious chart.yaml content

Octo STS Unauthenticated SSRF by abusing fields in OpenID Connect tokens

Gogs allows deletion of internal files which leads to remote command execution

Mattermost allows authenticated users to write files to arbitrary locations

Teleport allows remote authentication bypass

listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user

Navidrome Transcoding Permission Bypass Vulnerability Report

Navidrome allows SQL Injection via role parameter

Fabio allows HTTP clients to manipulate custom headers it adds

ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection

Argo CD allows cross-site scripting on repositories page

OpenFGA Authorization Bypass

Insufficient input sanitization in ejson2env

containerd allows host filesystem access on pull

Gardener allows metadata injection for a project secret which can lead to privilege escalation

Gardener allows bypassing project secret validation which can lead to privilege escalation

Gardener External DNS Management allows malicious google credential in DNS secret to lead to privilege escalation

OPKSSH Vulnerable to Authentication Bypass

OpenPubkey Vulnerable to Authentication Bypass

goshs route not protected, allows command execution

OPA server Data API HTTP path injection of Rego

OpenFGA Authorization Bypass

Volcano Scheduler Denial of Service via Unbounded Response from Elastic Service/extender Plugin

Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements

Rancher users who can create Projects can gain access to arbitrary projects

CVE-2025-24016KEV

Wazuh server vulnerable to remote code execution

Traefik has a possible vulnerability with its path matchers

NATS Server may fail to authorize certain Jetstream admin APIs

Dpanel's hard-coded JWT secret leads to remote code execution

Argo Events users can gain privileged access to the host system and cluster with EventSource and Sensor CR

Rancher: Restricted Administrator can change Administrator's passwords

Beego allows Reflected/Stored XSS in Beego's RenderForm() Function Due to Unescaped User Input

ngress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation

ingress-nginx controller - configuration injection via unsanitized auth-url annotation

ingress-nginx admission controller RCE escalation

ingress-nginx controller - configuration injection via unsanitized mirror annotations

PipeCD Vulnerable to Privilege Escalation

kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace

Ratify Azure authentication providers can leak authentication tokens to non-Azure container registries

Vela Server Has Insufficient Webhook Payload Data Verification

Fleet has SAML authentication vulnerability due to improper SAML response validation

Scan your dependencies for these CVEs