Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

317 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

Heimdall: Case-sensitive host matching may lead to policy bypass

Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation

Traefik has an StripPrefixRegex Middleware Authorization Bypass via Path/RawPath Desync

Traefik: Pre-authentication decision bypass due to forwarded alias spoofing

Traefik's ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass authentication

Contour has Lua code injection via Cookie Path Rewrite Policy

monetr: Server-side request forgery in Lunch Flow link creation and refresh

Daptin: SQL injection via unvalidated goqu.L() calls in aggregate API

Tekton Pipeline: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE

Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL

Neko has a Self-service Privilege Escalation for Authenticated Users

OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR

Dapr: Service Invocation path traversal ACL bypass

ACME Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider

NietThijmen ShoppingCart: Command injection in the connect function

Oxia's TLS CA certificate chain validation fails with multi-certificate PEM bundles

Kyverno has SSRF via CEL http.Get/http.Post in NamespacedValidatingPolicy allows cross-namespace data access

goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access

SFTP root escape via prefix-based path validation in goshs

Note Mark has Stored XSS via Unrestricted Asset Upload

SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`

SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering

Vikunja vulnerable to Privilege Escalation via Project Reparenting

Helm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory

kcp's cache server is accessible without authentication or authorization checks

Ferret: Path Traversal in IO::FS::WRITE allows arbitrary file write when scraping malicious websites

KubeAI: OS Command Injection via Model URL in Ollama Engine startup probe allows arbitrary command execution in model pods

SiYuan Desktop: Stored XSS in imported .sy.zip content leads to arbitrary command execution

nginx-UI has Unencrypted Storage of DNS API Tokens and ACME Private Keys

Gotenberg has Chromium deny-list bypass via case-insensitive URL scheme (bypass of GHSA-rh2x-ccvw-q7r3)

act: Unrestricted set-env and add-path command processing enables environment injection

Moby has AuthZ plugin bypass when provided oversized request bodies

Local Incus UI web server vulnerable to nuthentication bypass

Mattermost allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences

BuildKit's Malicious frontend can cause file escape outside of storage root

NATS has MQTT plaintext password disclosure

DigitalOcean Droplet Agent: Command Injection via Metadata Service Endpoint

etcd: Authorization bypasses in multiple APIs

Traefik has a Potential mTLS Bypass via Fragmented TLS ClientHello Causing Pre-SNI Sniff Fallback to Default Non-mTLS TLS Config

ingress-nginx comment-based nginx configuration injection

Juju has unauthorized access to out-of-scope Kubernetes secrets

Fullchain's Invalid NetworkPolicy enables a malicious actor to pivot into another namespace

Romeo is vulnerable to Archive Slip due to missing checks in sanitization

Monitoring is vulnerable to Archive Slip due to missing checks in sanitization

Romeo's invalid NetworkPolicy enables a malicious actor to pivot into another namespace

Chall-Manager's invalid NetworkPolicy enables a malicious actor to pivot into another namespace

Mattermost fails to properly handle very long passwords

github.com/ctfer-io/monitoring Vulnerable to Improper Access Control

Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint

SiYuan has a Full-Read SSRF via /api/network/forwardProxy

Scan your dependencies for these CVEs