Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

758 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover

Fission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhook

MCP Toolbox HTTP tool path parameters allow traversal to unintended endpoints

Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key

Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check

Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)

Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing

Incus has an arbitrary file write on its client due to trusted image hash

Incus has an argument injection in backup compression algorithm leading to AFW and ACE

Incus has an arbitrary file write via path traversal in S3 multipart upload

Incus has arbitrary file read+write on host via templates/ symlink in malicious image

Incus has a restricted project bypass leading to arbitrary command execution

Incus has an arbitrary file write on host via `exec-output` symlink in crafted image

Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image

golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement

golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status

golang.org/x/crypto vulnerable to infinite loop on large channel writes

golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed

golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses

golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys

golang.org/x/crypto doesn't enforce invoking key constraints

chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header

chi Middleware Vulnerable to Potential IP Spoofing via `X-Forwarded-For` Header in `Request.RemoteAddr` Resolution

Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir

Gogs's Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS

Gogs has Path Traversal in organization name that results in RCE through Git hooks

Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym

Gogs vulnerable to RCE via git rebase --exec argument injection in pull request merge

Gogs has a Migration Redirect Bypass that Leads to Internal Repository Theft

Gogs Vulnerable to CSRF Leading to Organization Owner Takeover

Gogs has Stored XSS in `.ipynb` Preview

Grafana: Pre-authentication denial of service in the public dashboard query handler

Canonical ADSys Uses a Less Trusted Source

Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability.

Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails

Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName

containerd CRI checkpoint restore CDI annotation smuggling

containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull

containerd: CRI checkpoint import allows local image tag poisoning

Hugo: security.http.urls deny rules bypassed by alternate IPv4 encodings (SSRF)

Tilt: Missing authentication on the network-exposed Tilt HUD server

Canonical MicroCeph: path traversal issue in the remote-import AP

googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken)

googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken)

Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode

Heimdall: IP Spoofing via Unvalidated Forwarding Headers

Gitea: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer

Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo

Gogs: Overwriting critical files results in a denial of service

Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix

Scan your dependencies for these CVEs