Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

403 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field

ntfy.sh allows a remote attacker to execute arbitrary code via the parseActions function

NornicDB has Improper Network Binding in its Bolt Server, allowing unauthorized remote access

RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution

Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution

openvpn-auth-oauth2 returns FUNC_SUCCESS on client-deny, allowing unauthenticated VPN access

Wish has SCP Path Traversal that allows arbitrary file read/write

Nhost Vulnerable to Account Takeover via OAuth Email Verification Bypass

Dgraph: Unauthenticated /debug/pprof/cmdline discloses admin auth token, enabling unauthorized access to protected Alpha admin endpoints

Pyroscope Exposes Storage Secret

OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing

Velociraptor vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token

Oxia has an OIDC token audience validation bypass via SkipClientIDCheck

OAuth2 Proxy's Health Check User-Agent Matching Bypasses Authentication in auth_request Mode

goshs has an empty-username SFTP password authentication bypass

Juju: CloudSpec method leaking cloud credentials

goshs has a file-based ACL authorization bypass in goshs state-changing routes

LXD: VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf

LXD: Importing a crafted backup leads to project restriction bypass

LXD: Update of type field in restricted TLS certificate allows privilege escalation to cluster admin

SiYuan: Remote Code Execution in the Electron desktop client via stored XSS in synced table captions

Memory-safety vulnerability in github.com/jackc/pgx/v5.

pgx contains memory-safety vulnerability

goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)

goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload

goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload

Dgraph: Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization

Juju has Improper TLS Client/Server authentication and certificate verification on Database Cluster

SiYuan is Vulnerable to Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection

SiYuan: Stored XSS in Attribute View Gallery/Kanban Cover Rendering Allows Arbitrary Command Execution in Desktop Client

nginx-ui's Unauthenticated MCP Endpoint Allows Remote Nginx Takeover

nginx-ui Backup Restore Allows Tampering with Encrypted Backups

Incus has an abitrary file write through its systemd-creds options

Incus vulnerable to arbitrary file read and write through pongo templates

OpenBao has Reflected XSS in its OIDC authentication error message

OpenBao lacks user confirmation for OIDC direct callback mode

Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR

SiYuan has directory traversal within its publishing service

SiYuan has Arbitrary Document Reading within the Publishing Service

CVE-2026-33634KEV

Trivy ecosystem supply chain was briefly compromised

Harbor allows the use of the default password for web UI login

Ory Oathkeeper has a path traversal authorization bypass

MinIO LDAP login brute-force via user enumeration and missing rate limit

MinIO has JWT Algorithm Confusion in OIDC Authentication

qui CORS Misconfiguration: Arbitrary Origins Trusted

step-ca has Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18)

Path traversal in Tekton Pipelines git resolver allows reading arbitrary files from the resolver pod

gRPC-Go has an authorization bypass via missing leading slash in :path

SiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183)

SiYuan Vulnerable to Arbitrary File Read in Desktop Publish Service

Scan your dependencies for these CVEs