Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

758 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure

Argo has Missing Authorization in its Sync ConfigMap Provider

Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loader

auth: Patreon provider assigns the same local user ID to every authenticated Patreon account, enabling cross‑user impersonation

Gotenberg has ExifTool stdin argument injection via metadata value newlines (bypass of key sanitization fix)

Gotenberg Vulnerable to Unauthenticated SSRF via Unfiltered Webhook URL

Gotenberg has case-insensitive URL scheme that bypasses webhook and downloadFrom deny-list SSRF protection

Nginx-UI has Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware that Allows Access to Internal Services

Note Mark: OIDC-registered users authenticated by submitting password "null"

Cillium exposes sensitive information included in the cilium-bugtool debug archive

zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write

Heimdall has an authorization bypass via path normalization mismatch

Heimdall: Case-sensitive host matching may lead to policy bypass

Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation

Traefik has an StripPrefixRegex Middleware Authorization Bypass via Path/RawPath Desync

Traefik: Pre-authentication decision bypass due to forwarded alias spoofing

Traefik's ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass authentication

Dgraph: Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars

Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field

Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field

Contour has Lua code injection via Cookie Path Rewrite Policy

ntfy.sh allows a remote attacker to execute arbitrary code via the parseActions function

NornicDB has Improper Network Binding in its Bolt Server, allowing unauthorized remote access

monetr: Server-side request forgery in Lunch Flow link creation and refresh

Daptin: SQL injection via unvalidated goqu.L() calls in aggregate API

RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution

Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution

openvpn-auth-oauth2 returns FUNC_SUCCESS on client-deny, allowing unauthenticated VPN access

Tekton Pipeline: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE

Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL

Neko has a Self-service Privilege Escalation for Authenticated Users

Wish has SCP Path Traversal that allows arbitrary file read/write

Nhost Vulnerable to Account Takeover via OAuth Email Verification Bypass

OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR

Dapr: Service Invocation path traversal ACL bypass

ACME Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider

Dgraph: Unauthenticated /debug/pprof/cmdline discloses admin auth token, enabling unauthorized access to protected Alpha admin endpoints

Pyroscope Exposes Storage Secret

OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing

Velociraptor vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token

NietThijmen ShoppingCart: Command injection in the connect function

Oxia's TLS CA certificate chain validation fails with multi-certificate PEM bundles

Oxia has an OIDC token audience validation bypass via SkipClientIDCheck

Kyverno has SSRF via CEL http.Get/http.Post in NamespacedValidatingPolicy allows cross-namespace data access

OAuth2 Proxy's Health Check User-Agent Matching Bypasses Authentication in auth_request Mode

goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access

goshs has an empty-username SFTP password authentication bypass

SFTP root escape via prefix-based path validation in goshs

Note Mark has Stored XSS via Unrestricted Asset Upload

Juju: CloudSpec method leaking cloud credentials

Scan your dependencies for these CVEs