Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

317 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix

Mattermost doesn't require role-management authorization when setting the scheme_admin flag on group syncable link and patch endpoints

Mattermost doesn't sanitize FileInfo.Name received from federated peers during shared channel file sync

Chisel has an ACL Bypass via Post-Handshake SSH Channel ExtraData Injection

AWS Advanced Go Wrapper has Privilege Escalation in Aurora PostgreSQL instance

DevGuard has improper authorization on public assets

Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS

Traefik has a StripPrefix Route-Level Auth Bypass via Path Normalization

nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml

Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project

authentik's XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user

Gotenberg has path traversal in zip entry name via Windows-style separators in upload filename

Calico Inserts Sensitive Information into Log File

Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs

Mattermost doesn't enforce request body size limits on plugin HTTP endpoints

Mattermost doesn't properly validate msgpack-encoded WebSocket frames before memory allocation

Arcane: Missing admin authorization on global variables endpoint

Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification

containerd user ID handling bypass allows runAsNonRoot evasion

Fission StorageSvc /v1/archive endpoint exposes unauthenticated CRUD over all function archives

Apache Camel K: Kubernetes namespace authorized users can create a Build resource

Mattermost has a Path Traversal issue

Caddy Defender trusted proxy client IP bypass

zrok copy writes attacker-controlled WebDAV paths outside the destination root

TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection

Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)

Arcane Backend: Unauthenticated reflected XSS via SVG color parameter enables admin account takeover

Mattermost doesn't sanitize sensitive configuration fields in the Mattermost Calls plugin

Mattermost doesn't sanitize sensitive configuration fields before including them in support packet generation

Crabbox: authentication bypass vulnerability that allows impersonation of others by spoofing identity headers

go-billy has path traversal vulnerabilities

Portainer Has an Arbitrary File Read via Git Symlink Injection in Stack Auto-Update

Portainer has a bind-mount restriction bypass via HostConfig.Mounts

Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload

HashiCorp Nomad vulnerable to a path traversal

Dalfox Server Mode has an Unauthenticated Arbitrary File Create/Append via `output` Option

Local Path Provisioner Vulnerable to HelperPod Template Injection

Dozzle's Cross-Site WebSocket Hijacking (CSWSH) on exec/attach endpointsbypasses authentication

Gotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List Bypass

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

Rancher Extensions have arbitrary file access via path traversal

Harvester's SUSE Virtualization Registration Client Vulnerable to MITM and DOS

Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure

Argo has Missing Authorization in its Sync ConfigMap Provider

Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loader

Gotenberg has case-insensitive URL scheme that bypasses webhook and downloadFrom deny-list SSRF protection

Nginx-UI has Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware that Allows Access to Internal Services

Cillium exposes sensitive information included in the cilium-bugtool debug archive

zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write

Heimdall has an authorization bypass via path normalization mismatch

Scan your dependencies for these CVEs