Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

403 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL

SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()

Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE

Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE

Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers

LocalAI POST /models/apply permits unauthenticated server-side request forgery through gallery URLs

Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket access

Gitea pre-receive hook scanner errors allow branch-protection bypass

Gitea OAuth2 authorization codes can be reused after expiry

Gitea repository creation accepts insufficiently validated fields

Gitea template repository generation follows unsafe filesystem paths

Gitea OAuth2 PKCE S256 verifier bypass

Gitea LFS mirror operations bypass migration HTTP transport protections

Rancher has Privilege Escalation from Project Owner to Host

Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer

Rancher vulnerable to command injection through unsanitized YAML parameter

Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation

Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape

Fission Container Executor Function PodSpec Injection Leading to Node Escape

Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover

MCP Toolbox HTTP tool path parameters allow traversal to unintended endpoints

Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key

Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check

Incus has an arbitrary file write on its client due to trusted image hash

Incus has an argument injection in backup compression algorithm leading to AFW and ACE

Incus has an arbitrary file write via path traversal in S3 multipart upload

Incus has arbitrary file read+write on host via templates/ symlink in malicious image

Incus has a restricted project bypass leading to arbitrary command execution

Incus has an arbitrary file write on host via `exec-output` symlink in crafted image

Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image

golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement

golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status

golang.org/x/crypto vulnerable to infinite loop on large channel writes

golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed

golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses

golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys

golang.org/x/crypto doesn't enforce invoking key constraints

Gogs has Path Traversal in organization name that results in RCE through Git hooks

Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym

Gogs vulnerable to RCE via git rebase --exec argument injection in pull request merge

Canonical ADSys Uses a Less Trusted Source

Tilt: Missing authentication on the network-exposed Tilt HUD server

googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken)

googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken)

Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix

MCP Toolbox for Databases has an Origin Validation Error

Openshift Migration Advisor agent-API fails to validate JWT source_id claim, allowing cross-tenant data manipulation

Openshift Migration Advisor lacks proper authorization and filtering for its DELETE /api/v1/sources API

Assisted Migration Agent: Path traversal in gzipped tarball handling enables arbitrary file write and remote code execution

Assisted Migration Agent: Hardcoded insecure Transport Layer Security (TLS) connections during vCenter communication

Scan your dependencies for these CVEs