Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

403 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

Chaos Controller Manager is vulnerable to OS command injection

Chaos Controller Manager is vulnerable to OS command injection

Chaos Controller Manager is vulnerable to OS command injection

Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation

pREST has a Systemic SQL Injection Vulnerability

Argo CD's Project API Token Exposes Repository Credentials

NeuVector admin account has insecure default password

Capsule tenant owners with "patch namespace" permission can hijack system namespaces label

Privileged OpenBao Operator May Execute Code on the Underlying Host

Hashicorp Vault has Code Execution Vulnerability via Plugin Configuration

OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion

NVIDIA Container Toolkit for all platforms contains an Untrusted Search Path

Gogs allows deletion of internal files which leads to remote command execution

Mattermost allows authenticated users to write files to arbitrary locations

Teleport allows remote authentication bypass

listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user

Fabio allows HTTP clients to manipulate custom headers it adds

Argo CD allows cross-site scripting on repositories page

Gardener allows metadata injection for a project secret which can lead to privilege escalation

Gardener allows bypassing project secret validation which can lead to privilege escalation

Gardener External DNS Management allows malicious google credential in DNS secret to lead to privilege escalation

OPKSSH Vulnerable to Authentication Bypass

OpenPubkey Vulnerable to Authentication Bypass

goshs route not protected, allows command execution

CVE-2025-24016KEV

Wazuh server vulnerable to remote code execution

NATS Server may fail to authorize certain Jetstream admin APIs

Dpanel's hard-coded JWT secret leads to remote code execution

Argo Events users can gain privileged access to the host system and cluster with EventSource and Sensor CR

Rancher: Restricted Administrator can change Administrator's passwords

Beego allows Reflected/Stored XSS in Beego's RenderForm() Function Due to Unescaped User Input

ingress-nginx admission controller RCE escalation

kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace

Fleet has SAML authentication vulnerability due to improper SAML response validation

IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations

GHSA-jg6f-48ff-5xrw

IBC-Go has Non-deterministic JSON Unmarshalling of IBC Acknowledgement

Mattermost allows reading arbitrary files related to importing boards

Mattermost allows reading arbitrary files

MaysWind ezBookkeeping has Improper Privilege Management

WhoDB has a path traversal opening Sqlite3 database

go-git has an Argument Injection via the URL field

Gogs has an argument Injection in the built-in SSH server

Gogs allows argument injection during the previewing of changes

Gogs allows deletion of internal files

GoCast OS Command Injection vulnerability

Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto

Osmedeus Web Server Vulnerable to Stored XSS, Leading to RCE

NVIDIA Container Toolkit contains a Time-of-check Time-of-Use (TOCTOU) vulnerability

Rancher Remote Code Execution via Cluster/Node Drivers

Rancher allows privilege escalation in Windows nodes due to Insecure Access Control Lists

Grafana Command Injection And Local File Inclusion Via Sql Expressions

Scan your dependencies for these CVEs