Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

758 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations

GHSA-jg6f-48ff-5xrw

IBC-Go has Non-deterministic JSON Unmarshalling of IBC Acknowledgement

Rancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First Login

Mattermost allows reading arbitrary files related to importing boards

Mattermost allows reading arbitrary files

S3-Proxy allows Reflected Cross-site Scripting (XSS) in template implementation

OpenFGA Authorization Bypass

MaysWind ezBookkeeping has Improper Privilege Management

WhoDB has a path traversal opening Sqlite3 database

Buildah allows build breakout using malicious Containerfiles and concurrent builds

Rancher UI has Stored Cross-site Scripting vulnerability

OpenFGA Authorization Bypass

go-git has an Argument Injection via the URL field

Karmada PULL Mode Cluster Privilege Escalation

OpenShift Hive RCE through AWS/Kubernetes client configuration leads to privilege escalation

Gogs has an argument Injection in the built-in SSH server

Gogs allows argument injection during the previewing of changes

Gogs allows deletion of internal files

Path Traversal in file update API in gogs

Remote Command Execution in file editing in gogs

GoCast OS Command Injection vulnerability

OpenShift Must Gather Operator Improper Input Validation vulnerability

Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto

Git credentials are exposed in Atlantis logs

Osmedeus Web Server Vulnerable to Stored XSS, Leading to RCE

Plenti arbitrary file deletion vulnerability

Plenti arbitrary file write vulnerability

NVIDIA Container Toolkit contains a Time-of-check Time-of-Use (TOCTOU) vulnerability

Rancher Remote Code Execution via Cluster/Node Drivers

Exposure of vSphere's CPI and CSI credentials in Rancher

Rancher allows privilege escalation in Windows nodes due to Insecure Access Control Lists

Grafana Command Injection And Local File Inclusion Via Sql Expressions

VM images built with Image Builder and Proxmox provider use default credentials in github.com/kubernetes-sigs/image-builder

SSOReady has an XML Signature Bypass via differential XML parsing

PAM module may allow accessing with the credentials of another user

Mellium allows Authentication Bypass by Spoofing

ZITADEL's Service Users Deactivation not Working

ZITADEL's User Grant Deactivation not Working

Dragonfly2 has hard coded cyptographic key

Chaosblade vulnerable to OS command execution

OpenShift Controller Manager Improper Privilege Management

OpenShift Builder has a path traversal, allows command injection in privileged BuildContainer

GoAuthentik vulnerable to Insufficient Authorization for several API endpoints

SQL injection in github.com/stashapp/stash

Gitea Cross-site Scripting Vulnerability

Juju's unprivileged user running on charm node can leak any secret or relation data accessible to the local charm

Mattermost allows unsolicited invites to expose access to local channels

Mattermost failed to properly validate that the channel that comes from the sync message is a shared channel

Authz zero length regression

Volcano has insecure permissions

Scan your dependencies for these CVEs