Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

758 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

goshs has a file-based ACL authorization bypass in goshs state-changing routes

SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`

SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering

LXD: VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf

LXD: Importing a crafted backup leads to project restriction bypass

LXD: Update of type field in restricted TLS certificate allows privilege escalation to cluster admin

Vikunja vulnerable to Privilege Escalation via Project Reparenting

Helm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory

kcp's cache server is accessible without authentication or authorization checks

SiYuan: Remote Code Execution in the Electron desktop client via stored XSS in synced table captions

Memory-safety vulnerability in github.com/jackc/pgx/v5.

pgx contains memory-safety vulnerability

goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)

goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload

goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload

Dgraph: Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization

Juju has Improper TLS Client/Server authentication and certificate verification on Database Cluster

Ferret: Path Traversal in IO::FS::WRITE allows arbitrary file write when scraping malicious websites

KubeAI: OS Command Injection via Model URL in Ollama Engine startup probe allows arbitrary command execution in model pods

SiYuan Desktop: Stored XSS in imported .sy.zip content leads to arbitrary command execution

SiYuan is Vulnerable to Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection

SiYuan: Stored XSS in Attribute View Gallery/Kanban Cover Rendering Allows Arbitrary Command Execution in Desktop Client

Fleet vulnerable to SQL Injection in MDM bootstrap package by authenticated team or global admin

nginx-ui's Unauthenticated MCP Endpoint Allows Remote Nginx Takeover

nginx-UI has Unencrypted Storage of DNS API Tokens and ACME Private Keys

nginx-ui Backup Restore Allows Tampering with Encrypted Backups

Gotenberg has Chromium deny-list bypass via case-insensitive URL scheme (bypass of GHSA-rh2x-ccvw-q7r3)

act: Unrestricted set-env and add-path command processing enables environment injection

Moby has AuthZ plugin bypass when provided oversized request bodies

Incus has an abitrary file write through its systemd-creds options

Local Incus UI web server vulnerable to nuthentication bypass

Incus vulnerable to arbitrary file read and write through pongo templates

OpenBao has Reflected XSS in its OIDC authentication error message

OpenBao lacks user confirmation for OIDC direct callback mode

Mattermost allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences

BuildKit's Malicious frontend can cause file escape outside of storage root

OpenFGA has an Authorization Bypass through cached keys

Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR

SiYuan has directory traversal within its publishing service

SiYuan has Arbitrary Document Reading within the Publishing Service

NATS has MQTT plaintext password disclosure

CVE-2026-33634KEV

Trivy ecosystem supply chain was briefly compromised

DigitalOcean Droplet Agent: Command Injection via Metadata Service Endpoint

Harbor allows the use of the default password for web UI login

Ory Oathkeeper has a path traversal authorization bypass

etcd: Authorization bypasses in multiple APIs

MinIO LDAP login brute-force via user enumeration and missing rate limit

Traefik has a Potential mTLS Bypass via Fragmented TLS ClientHello Causing Pre-SNI Sniff Fallback to Default Non-mTLS TLS Config

ingress-nginx comment-based nginx configuration injection

MinIO has JWT Algorithm Confusion in OIDC Authentication

Scan your dependencies for these CVEs