Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

870 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

Better Auth affected by external request basePath modification DoS

Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client

OneUptime Unauthorized User Creation via API

Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true`

authkit-nextjs may let session cookies be cached in CDNs

@anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes

md-to-pdf vulnerable to arbitrary JavaScript code execution when parsing front matter

@hpke/core reuses AEAD nonces

Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global variable

CVE-2025-11953KEV

@react-native-community/cli has arbitrary OS command injection

n8n Vulnerable to Remote Code Execution via Git Node Pre-Commit Hook

Kottster app reinitialization can be re-triggered allowing command injection in development mode

Mammoth is vulnerable to Directory Traversal

happy-dom's `--disallow-code-generation-from-strings` is not sufficient for isolating untrusted JavaScript

Flowise: Authenticated Command Execution and Sandbox Bypass via Puppeteer and Playwright Packages

Happy DOM: VM Context Escape can lead to Remote Code Execution

n8n: Execute Command Node Allows Authenticated Users to Run Arbitrary Commands on Host

Flowise is vulnerable to arbitrary file write through its WriteFileTool

SillyTavern Web Interface Vulnerable DNS Rebinding

Flowise vulnerable to RCE via Dynamic function constructor injection

Flowise is vulnerable to stored XSS via "View Messages" allows credential theft in FlowiseAI admin panel

check-branches is vulnerable to command Injection

get-jwks: poisoned JWKS cache allows post-fetch issuer validation bypass

cors-anywhere vulnerable to server-side request forgery

Command Injection in adb-mcp MCP Server

Flowise has unsandboxed remote code execution via Custom MCP

Flowise has arbitrary file access due to missing chat flow id validation

Flowise has Remote Code Execution vulnerability

FlowiseAI Pre-Auth Arbitrary Code Execution

Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover

CVE-2025-58754EPSS 0.1%

Axios is vulnerable to DoS attack through lack of data size check

Prebid-universal-creative latest on npm briefly compromised

interactive-git-checkout has a Command Injection vulnerability

DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware

@akoskm/create-mcp-server-stdio is vulnerable to MCP Server Command Injection through `exec` API

CodeceptJS's incomprehensive sanitation can lead to Command Injection

devalue prototype pollution vulnerability

sha.js is missing type checks leading to hash rewind and passing on crafted data

cipher-base is missing type checks, leading to hash rewind and passing on crafted data

Directus allows unauthenticated file upload and file modification due to lacking input sanitization

screenshot-desktop vulnerable to command Injection via `format` option

Flowise OS command remote code execution

content-security-policy-parser Prototype Pollution Vulnerability May Lead to RCE

js-toml Prototype Pollution Vulnerability

IPX Allows Path Traversal via Prefix Matching Bypass

@nestjs/devtools-integration: CSRF to Sandbox Escape Allows for RCE against JS Developers

Node-SAML SAML Signature Verification Vulnerability

Node-SAML SAML Authentication Bypass

NodeJS version of HAX CMS Has Insecure Default Configuration That Leads to Unauthenticated Access

form-data uses unsafe random function in form-data for choosing boundary

Scan your dependencies for these CVEs