Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

403 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

VM images built with Image Builder and Proxmox provider use default credentials in github.com/kubernetes-sigs/image-builder

SSOReady has an XML Signature Bypass via differential XML parsing

Mellium allows Authentication Bypass by Spoofing

Dragonfly2 has hard coded cyptographic key

Chaosblade vulnerable to OS command execution

GoAuthentik vulnerable to Insufficient Authorization for several API endpoints

SQL injection in github.com/stashapp/stash

Gitea Cross-site Scripting Vulnerability

Mattermost allows unsolicited invites to expose access to local channels

Mattermost failed to properly validate that the channel that comes from the sync message is a shared channel

Authz zero length regression

Volcano has insecure permissions

1Panel has an SQL injection issue related to the orderBy clause

Missing key verification in gost

Session Middleware Token Injection Vulnerability

Gin mishandles a wildcard at the end of an origin string

rke's credentials are stored in the RKE1 Cluster state ConfigMap

Files or Directories Accessible to External Parties in ProjectDiscovery

ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache

Grafana Race condition allowing privilege escalation

Grafana Fine-grained access control vulnerability

tiagorlampert CHAOS vulnerable to arbitrary code execution

Improper Access Control in Gitea

Privilege Escalation in kubevirt

HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches

Evmos transaction execution not accounting for all state transition after interaction with precompiles

LocalAI Command Injection in audioToWav

Bypassing Brute Force Protection via Application Crash and In-Memory Data Loss

Cross-site scripting on application summary component

Pterodactyl Wings vulnerable to improper isolation of server file access

Authorization Bypass Through User-Controlled Key in go-zero

Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials

BuildKit vulnerable to possible host system access from mount stub cleaner

Buildkit's interactive containers API does not validate entitlements check

Nginx-UI vulnerable to arbitrary file write through the Import Certificate feature

Django Template Engine Vulnerable to XSS

Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients

Capsule Proxy Authentication bypass using an empty token

CSRF Token Reuse Vulnerability

JWT token compromise can allow malicious actions including Remote Code Execution (RCE)

sing-box vulnerable to improper authentication in the SOCKS inbound

NATS nats-server allows directory traversal via unintended path to a management action

Argo CD cluster secret might leak in cluster details page

Account TakeOver Due to Improper Handling of JWT Tokens in usememos/memos

CasaOS contains weak JWT secrets

CasaOS Gateway vulnerable to incorrect identification of source IP addresses

Improper configuration of RBAC permissions obtaining cluster control permissions

Grafana vulnerable to Authentication Bypass by Spoofing

Rancher vulnerable to Privilege Escalation via manipulation of Secrets

Brook's tproxy server is vulnerable to a drive-by command injection.

Scan your dependencies for these CVEs